my dudes: charge yearly $$ to get a cert that allows you to request permissions higher than "access {camera, location while in use, microphone}" and most of the truly harsh PII issues go away afaict

the harm isn't consumer oriented, since it's somewhat diffuse, it's about concentration of market power in the industry.

we could live in a world where you target one distribution platform, and phone vendors compete to police malware, but instead we have walled gardens that police content & economically lock you to their environments and don't even do a good job about malware