I also encountered this issue with a helper app on macOS 11.5. My main app is sandboxed, codesigned, and notarized. I verified that's all in order using the codesign and spctl tools. I also used the xattr tool to verify that none of my apps or their files have the quarantine flag set.
The helper app is inside the main app's bundle. When the main app tries to launch the helper app via NSWorkspace I see these errors in the console log:
LAUNCH:Application launch of disabled, bundled executable is not permitted, so returning kLSNoLaunchPermissionError, <private>, status=-10826
LAUNCH: Launch failed in CSUI with error Error Domain=NSOSStatusErrorDomain Code=-10826 "kLSNoLaunchPermissionErr: User doesn't have permission to launch the app (managed networks)" UserInfo={_LSLine=3762, _LSFunction=_LSOpenStuffCallLocal}
handle LS launch error: {\n AppPath = "/Users/me/whatever/MainApp.app/Contents/MacOS/helper.app";\n ErrorCode = "-10826";\n}
It doesn't seem to matter whether my app is stored in the /Applications folder or elsewhere. Launching the helper app always fails.
I can clear the problem by manually launching the helper app in the Finder. Once I've done that the main app can also launch the helper app programmatically. Unfortunately this isn't a very friendly solution for customers.
If there's any way to workaround this issue, or anyone learns any more information about this situation, I would be very happy to know.