Depends on your definition of "allow". By default they're blocked, yes, but you can change that by booting into recovery mode, opening a Terminal window, and typing:

    csrutil disable && csrutil enable --without kext

Now unsigned kexts will be allowed to load (while leaving the rest of System Integrity Protection intact).

For most software this requirement would be a massive problem, but I'm not sure that applies to the type of person installing 3rd party graphics cards in Macs...

While I would agree with that in general, with the rise of the eGPU it seems a little less clear cut.

Oh well, it is what it is...

The nVidia Web Drivers never officially supported eGPUs anyway. In order to do it at all you had to use a hack which—surprise!—also required disabling System Integrity Protection!

https://9to5mac.com/2018/05/05/nvidia-egpu-thunderbolt-macos...