The macOS Application security model in Catalina is so broken. I dragged an App into Applications, authenticated it with my admin account, and it still only worked for the original account until I removed the com.apple.quarantine attribute and added +rx for everyone.