Is it allowed to publish the game executable with the "bare" .pak files if I use UE Marketplace assets in that game?

There would not really be a way to know that, that’s what the signature is for. If they downloaded your game and you didn’t encrypt it it’s out there, and they’d likely scrub it of a signature. Just take it down ASAP and put up your signed and encrypted version!