Gatekeeper helps protect users by checking downloaded apps before they first open and requiring user approval. It also uses file quarantine/origin tracking so macOS knows an app came from the internet or another external source. It doesn't automatically reject all non-App Store apps.

On a managed iPhone, device management can defer software updates, so the latest version may not appear yet. Also, if a VPN or proxy blocks access to Apple update servers, the iPhone may be unable to download or install the update. Apple's deployment guidance specifically describes managed update deferrals for supervised devices.