Sandboxing is a step in the right direction, as are various levels of things like code signing and even Windows Defender-esque systems that maintain lists of known malicious apps, authors etc and prevent them from running.

It also helps not to have an easy monetization scheme for malicious actors, either. Making it easy to give them money, and even sign you up for fraudulent subscriptions so you keep giving them money, is a mistake.

An actually user-friendly system would look at the apps that you're making payments with, and ask whether or not you want to keep subscriptions that you don't appear to be using much. This doesn't happen, though, because it is in no one's interests but the users' to help save them money.