If the files in those directories change the application signature will not be valid.
We need to fix this for next release by moving the python files and caches to a more appropriate path.

Wasn't pre-compiling __pycache__ intentional?, AFAIK these shouldn't have to be re-generated.

They are not regenerated and we generated them intentional.
The permissions on the folders they are in are non writable so they should not be regenerated ever as blender would not be able to write to them anyway.

We should ship the python stuff and extract that to ~/Library/application support on first run and that way keep it out of blender.app's bundle to work around these signing rules better.

Thank you for explaining this. When we deploy Blender to lab machines (or any other OS X machine) the files get copied to /Applications directory and the owner is set to root:wheel recursively. So in mass deployment situations Blender has never had a chance to write inside its own application bundle.

Would these cache files be recreated in some user space temp location if they were missing from the app bundle and user did not have write access to the folder?

Would these cache files be recreated in some user space temp location if they were missing from the app bundle and user did not have write access to the folder?

No, they just won't get created in that case - It will still work, just a little slower startup since Python modules won't be cached.