Like when Epic dangerously breached Apple’s security by allowing users to pay them directly for Fortnite skins.

Of course – Apple's App Store policies go beyond security, which is why it is critical for different stores with different policies to be able to compete. Its role in the threat model, though, is limited to automatic scanning and revocation.

That is also to say that if Apple does open up the platform to alternate stores, I imagine they will still control the security portion.

We're still at the same problem though, which is that Apple ultimately ends up having the final say on what apps get to run on consumer's devices.

Well, the real and underlying problem causing this is that they have the final say on what operating systems can run on iPhones. They don't do this for Macs.

Ultimately, though, someone needs to maintain a database of malware. When this malware is attacking the platform, it kinda makes sense for the platform maintainer to maintain the database. Microsoft maintains the Defender database, which does have false positives, and we thank them for it. If you want to override it, you can. Notarization works the same way on macOS.

That said, the neutrality of the database (malware only!), and the ability to override it are both key components.