This doesn't look evil. It looks like an internal stop-gap measure to prevent the execution of incompatible application versions that crash the OS. Most of the list are older versions of Apple's own apps.
It's "hidden" because it's almost certainly a hacky stop-gap. As far as I can tell, it isn't live updating or checking for new signatures, so the signatures are probably updated on a release basis as issues are found.
I completely agree. It looks like a nice hack that can help you ship in time. Let's say testing shows a few older apps that have drivers that really misbehave on the new system, and you really want to ship this week. To me, adding those apps to a fixed "do not run" list seems to be preferred over shipping later or shipping an OS that will crash with a large portion of your users. That is especially true if those apps have free or cheap updates.
Conspiracy theorists: for Apple, this technique dates back to at least the eighties or so. At some time, Apple introduced a system error "Application has special memory requirements" that basically meant "Sorry, we cannot run Excel 2.2" (text and version may be of). Reason was that that Excel used some bits in pointers for data storage. The new OS or hardware started using those bits itself, so that version of Excel could not run on with it. So, the Finder refused to run that program.
I'm pretty sure Microsoft has been doing the same thing at least since windows 95. I remember trying to run some old version of Nero, the CD-ROM burning tool, on a recent-ish version of Windows, and it popped up a message about known incompatibilities.
"Stop-gap" has a slight implication that it's temporary. A kludge may be forever.
Though, in this case, the stop-gap is at least indefinite from Apple's perspective, since they have no plans to restore binary compatibility for badly-written or otherwise broken drivers and applications, and it's up to the third-party vendor whether to issue a free patch.
It's "hidden" because it's almost certainly a hacky stop-gap. As far as I can tell, it isn't live updating or checking for new signatures, so the signatures are probably updated on a release basis as issues are found.