The two that I saw this were OrbStack and Podman Desktop, when their signatures were replaced (I think to ensure that their trampoline (launcher shim) apps could have the same signatures as the real apps).
Maybe apps that use Apple's virtualization APIs qualify here?
Here's the context of that experiment, after which I went back to installing those apps via brew and using them without such modifications: https://news.ycombinator.com/item?id=41126387