I'd argue you can see the hostility if you compare shipping to Windows vs shipping to Apple. Microsoft doesn't care if you copy over your MSVC suite into a Wine environment to build your software for their platform. Even SignTool just works. It's not necessarily trivial to do, but that's simply because the MSVC suite is a horrible mess like everything else Microsoft.
Apple explicitly disallows cross compilation in their Terms of Service. Even if you managed to get clang compiling for Mac on another Unix, even if you figure out how to get your app bundles signed outside of OSX, they'll revoke your developer license and invalidate your certs because you're in violation of their ToS. You're right they don't care about third party devs, but the amount of hoops you have to jump through for devops on Mac is almost certainly designed as a gluetrap.