As someone who works on developing cybersecurity products, it's incredibly unhelpful to disdain users by assuming the worst case as in

> who would download their banking apps from hax0rs.rus

Having empathy with users that don't act perfectly skeptical 100% of the time and who don't read all of the text (like none of us read 100% of the EULAs every time we click the "accept terms" button/checkbox) will allow us to build systems which are more robust to the occasional distracted user, overlooked typo, user who doesn't know how o mentally parse a URL to identify the domain, etc.

Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app stores, which necessarily means that users would have a higher cognitive load of researching which domains are more trusted app stores. It's ridiculously easy not to accidentally download an iOS app from a 3rd party app store, because they simply aren't possible without jailbreak / install developer cert.