The problem is that mobile devices can say "This app changes your VPN settings and installs a root cert". The general public says "Whatever, I want my olive garden gift card." It could could maybe say "This app could see everything you do online", but it really needs to explain "This app can see very site you visit, every message you send, every porn link you click, etc". Until the OS can actually inform the user what they're trading, it's not choice, it's deception.

And that brings us back to Apple. Until devices can do this for themselves, someone needs to be the gate keeper. Letting users willingly install some candy-themed clicker game that steals your contacts, location, and photos is _objectively bad_ in the same way that BonzaiBuddy and CometCursor were bad twenty years ago. Right now, the only answer we have to this problem is Apple and Google playing the role of the good guy and working towards better solutions.