I think the real issue is that without enforcement measures, apps by bad actors like Facebook have free rein to find holes in the sandbox and similar. Even in the event that iOS allows choice of App Store globally, it might not be the worst thing to let them keep a kill switch on automatic distribution of individual apps (which once flipped off, users would need to sideload the app in question) so when some third party dev tries to pull that kind of stunt there will be consequences.
Then Apple can just work harder on securing the OS. When desktop OS security is discussed does anyone ever seriously float the idea that maybe we should only allow MS, Apple, or Linus approved apps to run on the OS to avoid hackers having free rein to find holes?
The market for sideloading apps is anyway much smaller than the whole mobile market because most people can’t be bothered to do it. The ones determined to install that shady flashlight app they downloaded from the internet will just as well give their banking credentials to any app that asks for them.
No matter how much Apple invests into security, parties like Meta will find holes to exploit because it’s profitable to do so. It’s a cat and mouse game, and so even though Apple should be investing in security they also need to be able to put an end to the game when there’s obvious abuse afoot.
I’m not as supportive of this ability for computers, but the market is so broad and large for mobile devices that I feel it’s a bit of a different creature.
And yes, I agree that for sideloaded apps all bets are off. That’s why I mentioned Apple having a kill switch only on automated distribution, e.g. through app stores (first party or otherwise). So for example if it turns out that Facebook has been making constant use of exploits for a while, jumping from one to the next as they’re fixed — in this situation Apple can stop it from being installed or updated from any app store (even one run by Meta), meaning the only way to install or update it is through fully manual side loading until they clean their act up.
Meta doesn’t need to hack your OS. It’s not only cheaper to just ask you to give them all the access that matters to your data, it also poses less legal risk. You accept to install their alternative app and give them all the data they ask for.
Whatever technical tricks Meta is using today pass Apple’s review and implicit endorsement. Whatever tricks they use in the future to escape the sandbox and access (hack) the OS with the sideloaded app are unilateral. Could open up a legal can of worms.
I’d be more concerned about the shady flashlight app downloaded from some corner of the internet. Or the Fakebook app, the all-in-one social media aggregator, the fake banking apps.
