AOSP makes no difference I think. If you are locked out of the official store, you are locked out of "Android" as people recognize it.
Mobile application permission systems don't cease to exist in the absence of a sanctioned app store. The only thing that disappears is the ability for Google or others to completely remove an application that is abusing the permissions a user granted: but the permissions are still there.
Even in the worst-case scenario, malware on modern phone operating systems is substantially more limited in disruptive and destructive power than what one can achieve on Windows without a UAC grant.
Permissions systems definitely do not anything against malware. See: all the flashlight apps with every permission under the sun.
>Even in the worst-case scenario, malware on modern phone operating systems is substantially more limited in disruptive and destructive power than what one can achieve on Windows without a UAC grant.
Sure, but it can still collect all your pictures, have access to your microphone/cameras, and tarck your location. It's better than full control of your device, but it's not that much better.
oh the irony!
Making a good OS is hard, and getting market share in an established market is very, very difficult.