Can users/enterprises download and resign IPA within Apple ToS? I have an app in the Apple App Store, and am curious whether Apple ToS permits end-users and enterprises to download my (or any) app and redistribute them using enterprise certificates (e.g. MDM) or ad-hoc Apple developer distribution?

I haven't been able to find any direct information regarding Apples stance on the matter.

As far as I know, tools exists that can change the bundle id and then using a custom provisioning profile resigning and distribution is possible outside of the Apple App Store.

(Also asked on SO: https://stackoverflow.com/questions/39971753/can-users-enterprises-download-and-resign-ipa-within-apple-tos)
It depends of the EULA you give to the user in iTunes connect. Apple has a standard default Eula you can override it if you want.

https://developer.apple.com/library/content/documentation/LanguagesUtilities/Conceptual/iTunesConnect_Guide/Appendices/Properties.html#//apple_ref/doc/uid/TP40011225-CH26-SW13