If malware isn’t user-hostile, I don’t know what is? It works both ways. A fork can fix something that’s user-hostile, but it can also introduce malware into an otherwise useful app that didn’t already have it, and many users won’t know which one to install. There’s no guarantee that any security researcher is watching. In practice we rely largely on reputation, and sometimes that’s the blind leading the blind.

Users don’t get final say in what their devices do unless a software developer is willing and able to help them. Most are actually pretty helpless on their own.

Yes, forks can do anything. That's the point: to make it possible to create software that behaves the way the user wants and not just the way it was originally programed.

There are lots of ways to figure out what version to install; which is a lot better than having literally no choice because there's only one option available: the one with homescreen ads/government backdoors/seat heater subscriptions.

Will some users make the wrong choice? Yes. Is that a valid justification for treating everyone like children unable to make decisions for themsleves? Absolutely not. Just as there are other ways to prevent real-wold crime than by locking everyone in concentration camps, there are other ways to prevent cybercrime than by locking everyone in an inescapable walled garden.