There are other possible approaches that could be taken - e.g. a full bootloader wipe required, per-app permissions that must be allowed, federated third party app stores, parental controls, etc.

Although at the end of the day people will still sometimes self-XSS themselves with the browser developer console or get phished etc.

Human error/ignorance is always a possible issue, and I don't think we should restrict everyone else for it. Cars and knives are still allowed in the world.