Protected customer data access for unlisted app?

[few_meaning]

I'm writing an application that has functionality triggered by the reception of Shopify webhooks. For an unlisted app, I cannot subscribe to e.g. the ORDERS_CREATE webhook because of data protection policies. Looking at requesting access, that seems to be something with listed apps only.

Is there a way to deploy my app to a development store and access "protected customer data" (that's all fake, because all the data in the store is fake) to test the webhook integration? How are other people using Shopify-sourced webhooks during application development/testing?