Apps are sandboxed. In order to access certain features, they need to request permission from the operating system. e.g. there is a GPS chip in your iPhone. Apps, through the design of the OS (not the App Store), are unable to access the raw data coming from this unit themselves. Instead, they tell the OS "hey, I want access to location data", at which point the OS throws up a notification to the user asking if they want to allow the app access to that data. The user says yes, and the OS starts to provide the app with location data. At any point, the user can tell the OS "hey, stop giving this app access" and the OS will oblige. The App Store does not enforce this functionality at all, it is enforced at the OS level. Allowing 3rd party app stores would not change this. If Apple's App Store vetting process disappeared tomorrow, Spotify would not be able to get location data without the user's permission.
As a side note, I keep saying "at the OS level", but this is a simplification on my part. In more than a few places, Apple has gone further and done things like have the Secure Enclave which has complex interactions with the OS / kernel to make certain actions difficult even if you break out of the OS-level sandbox.
Let me flip the question, are you aware what types of data apps collect in order to fingerprint a device? These are the same low level APIs that apps need for legitimate purposes, you can't simply disable them or put a permissions prompt in front of each one.
This is why I prefer an E2EE chat service to a service that is not but says "we promise we won't read your messages".
You're also neglecting the fact that malicious apps can mislead the user by prompting for permissions for a seemingly legitimate purpose and then abuse those permissions once granted.
This is self-contradictory. If Apple allows third-parties to distribute apps outside the App Store, they lose the ability to enforce their App Tracking and Transparency rules.