Sophos installs for standard Users - SophosCBR.bundle gatekeeper prompts

Has anyone tried downloading the mac os installer from sophos central, and deploying it via jamf onto big sur machines?

We used the old method of downloading the full installer from sophos central, unzip the file to a folder in the tmp folder then running a install command via a policy to install the client.

sudo /private/var/tmp/app/SophosInstall/Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer --install

 

This seem to install on the machines as it previously did however sophos does not update / run correctly. There is nothing showing there is a error. Sophos central only shows Real time protection disabled. It stays like that even after reboots.

The only difference is when you log onto the machine with a admin account you get a gate keeper message saying "sophosCBR.bundle" is an app downloaded from the internet. Are you sure you want to open it? Chrome downloaded this file on (date). Apple Checked it for malicious software and none was detected. The options it gives is cancel or open. If you select open sophos starts to update and work as normal.

That gate keeper prompt does not appear for standard users. iam going to try repackaging the files running a xattr command before packaging, but wanted to know if this was a known issue / anyone else had come across it before?