Just stumbled upon this issue when using an XCFramework Swift package and found a solution.
To enforce a specific code signing version you need to use two extra command line options:
-o, --options flag,...
During signing, specifies a set of option flags to be embedded in the code signature. The value takes the form of a comma-separated list of names (with no spaces). Alternatively, a numeric value can be used to directly specify the option mask (CodeDirectory flag word). See OPTION FLAGS below.
--runtime-version version
During signing, when the runtime OPTION FLAG is set, explicitly specify the hardened runtime version stored in the code signature. If this option is omitted, but the runtime OPTION FLAG is set then the hardened runtime version is omitted for non-Mach-O files and derived from the SDK version of Mach-O files.
Adding the following options will result in a v=20500:
runtime --runtime-version "16.4.0"
After this the app successfully installs on a device.
You can add those option to the OTHER_CODE_SIGN_FLAGS in the Build Settings of your app target.