Can users/enterprises download and resign IPA within Apple ToS?
It depends of the EULA you give to the user in iTunes connect. Apple has a standard default Eula you can override it if you want.

https://developer.apple.com/library/content/documentation/LanguagesUtilities/Conceptual/iTunesConnect_Guide/Appendices/Properties.html#//apple_ref/doc/uid/TP40011225-CH26-SW13