But that's exactly what `sudo spctl --master-disable` does! You'll still see a warning dialog on first launch.