I believe this applies to the direct Apex access to parts of the Metadata API.
My impression is it prevents any old random installed package from using the new functionality to then deploy further Metadata without your permission.
To make clear, deploying (some) metadata from Apex in certified packages is also supported--in fact, it's the primary use case. There's a subscriber org preference to allow non-certified managed packages to do it too, if you want to allow that, but that's a sort of side note.
From Avrom Roy-Faderman's (Principal developer of custom metadata types and metadata API in Apex) comment:
I can confirm this. In general, installed managed packages don't have access to metadata API in Apex unless they've been certified by our security team (the same process that makes them eligible for AppExchange listing). But
- Package developers need to test how their code will function in subscriber organizations before getting certification, and
- Some enterprises use managed packaging as part of their internal app lifecycle.
The setting allows package developers' test organizations and enterprises that use managed packaging internally to let those packages run without pre-certification.
I don't think you'll get a more authoritative source than that :)
Security Considerations docs link also provided by Avrom
Be aware of security considerations when accessing metadata using Apex.
Generally, Apex classes installed in the subscriber org can access any public, supported metadata type or component in the subscriber org. Protected metadata, such as a custom metadata type that’s been marked protected, can only be accessed by Apex classes in the same namespace as the protected metadata.
Additionally, for managed packages, if the managed package is not approved by Salesforce via security review, Apex classes in the package cannot access metadata (public or protected) unless the Allow metadata deploy by Apex from non-certified Apex package version org preference is enabled. This preference, located under Setup | Apex Settings, must be enabled if admins or developers are installing managed packages that haven’t passed security review for app testing or pilot purposes.