It seems that macOS Catalina may require that all "Apps" (which I believe covers GHC, although it is such a vague term that it is hard to tell) must be "notarized". I suppose this is yet another hoop that we will have to jump through. Sigh...
Users can explicitly mark the binary distribution as trusted after extraction by running
xattr -rc $path_to_bindist_directory.