Apple should be to blame. Even registered and paying iOS developers aren't allowed basic sideloading privileges you'd get for free on Android. This isn't about stopping Little Timmy, this is about annihilating all avenues of app distribution that doesn't come from Apple. If Apple took a softer stance on this earlier, then developers wouldn't be up-in-arms right now.

And mind you - nothing actually stops Apple from designing a safe and respectful sideloading system like MacOS. They actively choose to make iOS a diminished and neutered platform for profitability purposes. People will blame Apple, and they will be right - Apple brought this upon themselves. There is no one else to blame.

How is it Apple’s problem when someone designs an alternate App Store with no safeguards or parental controls?

Because it's Apple's problem regardless. The iPhone is at-odds with it's identity of security and privacy even without the threat of sideloading. The App Store, a supposedly curated and well-reviewed platform, is dominated by pay-to-play games and ad-supported datamining apps. First-party Apple software like iMessage is perpetually vulnerable to escalation attacks due to the way it's designed. iCloud is basically a fancy sticker on state-owned and surveilled datacenters that Apple markets for an easy buck.

Now, they want to argue that sideloading is the straw that breaks the camel's back? Not Safari, which has enabled lord knows how many scams and privilege escalation attacks. Not the App Store, which disseminates exploitative and fraudulent content under the guise of simplicity and security. Not iMessage, the perennial attack-vector for escalated malware. Somehow it's the sideloaders who are the problem, for daring to suggest that the iPhone should rely on OS-level security rather than arbitrary (and often wrong) first-party curation.

Who do you suggest we blame?