Personally I think the real problem is that the OS is fundamentally broken. All current OSes are fundamentally broken from a security point of view because they all pre-date the era when security was such a concern and are designed to run only de-facto trusted code. All the security we have including all iOS's security is a bolt-on afterthought.

A modern security and privacy conscious OS would be "principle of least privilege" from the ground up. It would be written into the DNA of the kernel and OS from the first line of code, not bolted on later via permission managers and leaky APIs and then mandatory notarization by a central authority to work around the fact that the whole mess is still insecure.

We do have something like that. It's called a web browser. A browser is a small VM that runs utterly untrusted code relatively safely. In many cases it's code from the sketchiest ad networks and other hellholes imaginable.

Imagine if your real OS were like that. Install anything even known malware with fairly strong confidence that you're safe and that it can't do anything you don't explicitly grant to it.