Gatekeeper checks downloaded apps against a known list of malicious software and verifies a valid developer signature before allowing them to run, catching a large share of casual malware before it executes.
Notarization goes a step further, requiring developers to submit apps to Apple for an automated security scan even outside the Mac App Store.
These layers are not foolproof, and sophisticated attacks still get through occasionally, which is why keeping macOS updated remains the single most effective defense.