This is a totally unrealistic scenario. Victims of scam trust the person on the phone much more than their own ability to figure out what's going on. Scammers successfully convince people to manually disable every protection and dismiss every warning the computer throws at them regularly.

No amount of software red tape is going to prevent scammers from sideloading malware on a device of a victim who trusts them. The only realistic way to actually prevent it is to not have sideloading as an option in the first place.