For all of Google's faults, and there are many, it is still to this day possible to install any software I want on my Android phone. I recognize that in the wrong hands this can go wrong, but there should always be an escape hatch, even if that escape hatch is buried under a hundred "Warning what you are doing could be insecure" dialogs (and they should be).
That being said, things aren't all peachy on the Android side: My understanding is that third party app stores for instance rely on the user's phone being configured to accept code from unknown sources -- instead it should be possible to acquire a Store in a safe and secure way, and delegate to that store the ability to install software from that store, without requiring Unknown Sources to be on. Maybe this has changed recently, I hope someone will pipe up to correct me if it has!