I say this as someone who enjoys having an iOS device but also knows that Apple absolutely can allow other app stores in a secure (PKI based) way. They're just choosing not to do so for monopolistic reasons but talking about safety.
If we think of the PKI trust chain, and the Apple App Store as a root authority, there's no reason why ecosystem vendors (like MS, etc) couldn't be "intermediate CAs", with their own app stores, with strict rules in place for running one.