My threat model is an evil maid attack, ie. someone watches over your shoulder as you enter your passcode, then steals your phone from your hotel room and sideloads malware (that hides the fact that it's been sideloaded).

I'm sure it's possible on Android to install enterprise management or MAM solution that locks down side-loading, locked behind some custom password (not the regular password that the maid would see)