Would you be able to point me toward that bundle you got it from? - perhaps by a direct message.
FWIW here is the signature verification on the subdependency in question:
codesign -d -vvvvv --architecture x86_64 /Users/rb/repo-rt/build/RawTherapee.app/Contents/Frameworks/*gomp*
Executable=/Users/rb/repo-rt/build/RawTherapee.app/Contents/Frameworks/libgomp.1.dylib
Identifier=com.rawtherapee.RawTherapee
Format=Mach-O thin (x86_64)
CodeDirectory v=20400 size=3871 flags=0x10000(runtime) hashes=112+5 location=embedded
Library validation warning=OS X SDK version before 10.9 does not support Library Validation
VersionPlatform=1
VersionMin=720896
VersionSDK=0
Hash type=sha256 size=32
CandidateCDHash sha1=7a0b3f85daa81960b865bcba77a3bc113049dfec
CandidateCDHashFull sha1=7a0b3f85daa81960b865bcba77a3bc113049dfec
CandidateCDHash sha256=9e4aa5933a7ae98c7b931e61b3175a54f62491bd
CandidateCDHashFull sha256=9e4aa5933a7ae98c7b931e61b3175a54f62491bdb8ecab95694e7e8e03eea40f
Hash choices=sha1,sha256
CMSDigest=bc52e9c8a076c76bac19be43dc87476e31ed9da29618f95423ca3ce4b986c267
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=294912
Executable Segment flags=0x0
Page size=4096
-5=77e187a2b9b378f6a5846c1ec7329bcb90fdb9a8693860b567ac2b5c894286e9
-4=0000000000000000000000000000000000000000000000000000000000000000
-3=0000000000000000000000000000000000000000000000000000000000000000
-2=e32bf4b288679d9e45e62bc33b04e737126f74a5fd8016728a21eda9939023f8
Launch Constraints:
None
CDHash=9e4aa5933a7ae98c7b931e61b3175a54f62491bd
Signature size=9060
Authority=Developer ID Application: Richard Barber (5SJ86G6Q2R)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Feb 2, 2024 at 11:08:57 AM
Info.plist=not bound
TeamIdentifier=5SJ86G6Q2R
Sealed Resources=none
Internal requirements count=1 size=188