What is the exact behavior of Catalina verifying app?
I’m not sure that anyone knows the full extent of how Apple’s protections work, but if I wanted to understand them better, I would start by reading Howard Oakley’s site at http://eclecticlight.co as he has done the most thorough job writing about it.

I know SE likes answers that aren’t just links, but there's way too much to try to summarize here.

This would be a good place to start reading: https://eclecticlight.co/tag/gatekeeper/