Why would Boox disable sideloading on their own Android build? Your comment makes as much sense as saying Google is going to disable sideloading on LineageOS and GrapheneOS. Boox doesn't give a flying shit about Google's Android certification program. Google has no claws on devices that have to sideload Play Store.

Is that true for people building off of open source android components (like Boox is doing)? What would you recommend as an alternative? As others have said, I doubt Google can disable sideloading when google play must be sideloaded on the device.