As a bonus, they could make the app curation system extendable, so other groups could run vetting programs. By default your device would only have Apple as a trusted vetter, but as part of a management profile or something you could also trust apps vetter by some security research group, or Epic, or Valve, or whoever. That way security isn't all-or-nothing.
And of course, if anything slips through and your layman user OKs all the warnings and installs a malicious app, it's still operating in a sandbox, and can't do much more harm than clicking a shady link and ending up on a scam website can.
And yet the choose one scenario is the one that has worked best for me. My dad would fill up his Android phone with malware regardless of scare screens. The solution was simple, and allowed at least him and I to spend more time doing other things.
Just like I how don’t spend my time learning how to fix a tractor that my grandpa knows how to fix.
What about not having to deal with malware?
They should have spent their time browsing the internet, reinstalling Windows over and over, and reading HN, hopefully learning the signals that can ensure they won’t have some program steal their login credentials to their bank accounts.
So lazy of them to do other things in life such as cooking, cleaning, raising a family, and building a business as immigrants in a foreign country.