Epic lied about the content of their software. If Apple doesn’t remove software from suppliers who lie about the contents, people will continue to exploit this.
There was no overreach. This was the consequence of Epic intentionally lying about the content a software update.
It’s also worth pointing out that Epic expected this result, and caused it on purpose. Both Apple, and the court gave them the chance to rectify the situation which they refused.
That makes Epic responsible for the outcome. No one else.
Again, I fully agree that Epic was knowingly in breach of their contract with Apple, and wanted to use the public as leverage. But that doesn't, in any way, make their update malicious for the end user.
As for whether the update was malicious for the end user, we could say we trust epic to operate a payment method, and therefore the update was not malicious.
But there are many actors who would use this exact same methodology, and the update is malicious. Such Trojans exist on Android.
Security policies always prevent behaviors that could be used for non-malicious purposes.
If the argument is that the end users should be the ones to decide, it’s really just another way of saying that Apple shouldn’t be allowed to enforce any security policy.
Of course there are those who believe that Apple shouldn’t be able to enforce security policies, but there is no overreach here.
Sure, Apple was completely in the right to stop distributing Epic software after they breached their contract with Apple. But Epic didn't breach any contract with their users, so there was no reason to remove Epic's software from user devices, or affect companies redistributing Epic software. Those are obvious overreach.