How are app stores the only means of providing reasonable security? They already fail at that job. A huge number of apps, including popular ones, request as many permissions as they can.

In what world do I want a transit app listening to my microphone?

There isn't anything that precludes security in an app store-less world. If we sat for an hour, we could whiteboard a number of technical solutions that could be engineered.

- apps still require signing

- implementing a stricter permissions / ACL model

- continuously scan devices for malware or bad heuristical behavior

- publish a list of misbehaving apps that can be subscribed to and automatically scrubbed

- semantic sets of app permissions. Gallery apps don't get microphone, contact, or location data.

We could easily engineer for a distributed world. The problem is that Apple and Google want complete control. Playing gatekeeper gives them authority, and they get to take a large rake of any money being made.

Don't make excuses for their model. They're bad actors that have abused their monopoly powers.