> What happens when installing Facebook requires this setting to be disabled because it's only installable with their own App Store and rampant with privacy intrusions?

You can then add a regulation that all popular social apps need a web version that is fully functional. If the OS should support the necessary web APIs for a good app experience, people can choose that instead.

Considering the app permissions are still controllable via the OS, I don’t see how the app can become “intrusive” anyway. Just deny it the unnecessary permissions.