Are there? Really? No, they're not. No one who isn't in tech is going to install F-droid. Few people will uninstall untrusted sources, or even know what that is. Fewer Apple users than ever jailbreak their phones.
For over 90% of the market, no, there are no alternatives (other than a mobile website). Due to the non-standard nature of ARM and SoC/binary drivers, we don't even have a real alternative OS for old Android devices that's universal like most Linux distros on the PC in the 90s (although PostmarketOS is making some huge strides in this area).
30% is an insane cut. Bandcamp sells music with a 15% cut, literally half of Amazon/Google/Apple. I always prefer it because I know the band gets more money and I get a higher quality version of the song without a patent encumbered codec (FLAC and OGG downloads are supported).
But no, there are no real alternatives. AppStore/Play are bastardizations of the software repo concept from Linux.
If Google Play was a real package managers, it'd keep standardize shared jar files across apps (dependencies to reduce massive app size) either by mirroring maven repos and signing dependencies or creating their own system, and they'd also allow for easily adding 3rd party app trees.
Both Apple and Google are closed walled gardens, where everything you need has to be contained in your bloated package, and where their corporate overlords get final approval of what is in and out.
After all, there are alternatives to bridges, why do the travelers opt to pay the fee?
-- Obviously, /s
Talking about my own experience, once we've made clear that In-App Purchase wasn't a fit for us as we already had our own payment system (we are a SaaS business), things got way more difficult to us. As you can imagine (but I didn't at the time), our app would be in review for weeks sometimes, we started to see arbitrary denials and a lot of "issues" not present on their guidelines started to be identified on our apps.
If there is one thing that I'm now sure is that, if you decide to not play their game (even though following their rules) there will be retaliation.
Not if you want to build a secure system which runs on an iPhone, there aren't. JavaScript crypto is fundamentally insecure; the only secure option is a native client.
As you point out, there are alternatives. Why do you think developers have massively and overwhelmingly opted-in?