His grandmother already has an iPhone, so it's unlikely that she was using Android 10 or 11 (which made it fairly easy to install an apk file). Until Android 9 you had to go through some menus and allow sideloading, something that "clueless" people usually don't do. It's more likely that the "malware" came from an app installed via the Play Store.

Three or so years ago I was asked by someone to see if there was a virus on their phone. The "virus" was in fact a religious app, installed via the official store, which was opening a popup with ads every few hours.

Now, I could be wrong and it's possible that his grandma actually sideloaded an apk. If she did, I still think that you should be able to install an app that isn't allowed by Apple on their store, after all they block more than just malware: apps with free licenses, some VPN apps in some countries, torrent apps without any illegal content in it, etc.

If Apple wants to continue on this path, hopefully they'll go a step further and also remove the web browser and the ability to receive calls. Scam calls are a problem after all and we don't want people to send all their savings to "Microsoft" or "Amazon".

Not only that but I don't see how this problem isn't just trivially solved by putting an optional "parental" control on the setting. God forbid someone has to take 5 seconds to set a phone up for their mum.