At [1]:
---
String defPath = (APP_STORE.fetchFrom(params) ?
    "sandbox.plist" : "entitlements.plist");
createResource(defPath, params)
    .setCategory(I18N.getString("resource.entitlements"))
    .saveToFile(path);
---

The "defPath" variable is set to the default resource name.
There is "sandbox.plist" at [2], but there is no "entitlements.plist". The "defPath" variable should be set to null Instead of non-existing "entitlements.plist" null to indicate that jpackage doesn't supply default entitlements for non-app store app signing.

The code should be corrected, and a relevant test should be added.

[1] https://github.com/openjdk/jdk/blob/aad6664bb6d2b311b3e0cb056afaa9b6534bdbbb/src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/MacAppImageBuilder.java#L165
[2] https://github.com/openjdk/jdk/blob/aad6664bb6d2b311b3e0cb056afaa9b6534bdbbb/src/jdk.jpackage/macosx/classes/jdk/jpackage/internal/resources/sandbox.plist