> I'd wager that the average user cares much more about protecting, say, their browsing history,
No, you won't, for a lot of reasons.
1. If people gave a fig about their browsing history, they wouldn't have Facebook accounts. (Which, combined with tracking cookies, do a great job of leaking their browsing history.)
2. If people gave a fig about their browsing history, they wouldn't use browsers with omnibars.
3. Or browsers which sync their accounts across multiple computers/devices.
3. People don't even understand which part of the tech stack (The OS, the app, the browser, the website, the third-party cookies served by the website) that they use actually compromises their information.
4. Unless you're a political dissident being hunted by the CIA, the House of Saud, and the Mossad, when this information is compromised, the harm is difficult to quantify, and is never directly linked to the part of the stack that caused the compromise.
Ask five different people 'Who knows your browsing history?', and you will get five different answers, all of which will be wrong. If normal people cared about this in the particular, they'd be tech-literate about this sort of thing. They aren't. As long as some asshole is not using that compromised browsing history to harass them personally, as long as it's being used in the abstract, by some information broker to show them ads, most of them don't give a damn. I know that they don't, because they don't take any steps to secure it.
Obviously, the users don't care about the B2B spat between Apple and developers. I'm not asking them to - I'm pointing out that rigged markets rarely produce good products.
The issue is that the rules for Facebook on the App Store isn't subjected to the same rules as <Small competitor> on the App Store.