Also, trustworthy people do not ask you to trust them.
I am honest and trustworthy, and so if you gave me the pin to your debit card to go buy something for you, I would not mis-use that information.
But because I am honest, I would never ask you to trust me with your pin. If we were standing next to each other at a pos, I actively look away when you start to type so I don't even find it out by innocent accident.
Honest people take the trouble to figure out some way to get a job done without requiring you to trust them, even if you would have, even if it's less convenient for you both.
In fact, I think that one thing is probably the single biggest proof of trustworthiness.
A person or organization that I've never met before and and does not ask me to trust them, is more trustworthy than one that I've known for years and have a long history of good interactions with.
And I would agree it should be outrageous and intolerable.
I wonder if there might be some way for a developer to post their own hashes somewhere, but then there's no good way for an end user to use them to verify their phone.
You could post a web page that reports that Apple has not modified the contents of your app, or a site could do that for many apps, by downloading the Apple-repacked app and checking it, but you could only check the copy of the app that the site downloaded.
It would not prove that Apple didn't modify the individual copy of the app residing on anyones phone.
I don't know the details of ios userspace, but I extremely doubt it's possible for the browser or any other app to read some other apps files and uload them to a site to have them checked. So you couldn't make a 3rd party site that says "check my phone".
Maybe such a report could be made by reading the app out of an unencrypted backup?
Twitter, JSON/ATOM/RSS feeds, apps in privately hosted F-Droid compatible repos...etc
They haven't — which is bad — but they could, and that would be a guarantee. Same as you get with reproducible binary packages in Debian.
On Android, the original security model was that the developer signs the code, preventing a distributor from modifying it (as long as the signature checks are sound).
Apple's system is worthy of complaining about, but you can only bring it up so often. Google taking Android backwards in this regard is worth making a fuss over; but Google is likely to just steamroll through.