I don't think sideloading in itself is necessarily a threat to privacy. It's unquestionably a downgrade in security thanks to the existence of social engineering, but that might be something we just have to live with.

Where the real threat, in my opinion, lies is with third party app stores. It's easy to imagine Facebook for example launching its own app store where rules for information gathering are lax or nonexistent and then forcing its success by making the powerhouse apps it controls exclusive to it - a lot of people wouldn't think twice about installing a questionable app store if that were the only way they could get Instagram, WhatsApp, Facebook Messenger, etc. There's also no shortage of unscrupulous developers who would jump aboard their platform for the anything goes policies.

One could argue that users have a choice in that situation, but that's not really true, particularly where network effects are concerned. Most people are not going to switch to Signal for example if WhatsApp becomes a Facebook Store exclusive - they're just going to install the Facebook Store and get on with life, because the energy involved in getting entire social groups moved over just isn't there.

Technical solutions to this privacy problem like sandboxing sound good on paper, but there will always be holes, and if the gatekeeper is happy to look the other way when developers use said holes (as Facebook themselves have in the past), those protections may as well not exist. Even if Apple puts maximum effort into closing off these holes, it'll be an endless cat and mouse game with user information dripping out the whole way.

Some will point out that third party app stores and sideloading have been possible on Android since forever and the above described outcome hasn't occurred, but the incentives are quite different in the case of iOS/App Store, both financially (iOS user eyeballs are worth a lot more) and from a policy standpoint (the App Store, historically, has been much more strict than the Play Store). It could also still happen in the case of Android, and is perhaps even likely given how Google has been tightening the bolts on the Play Store's policies.

So, my thought is that any legislation that forces the ability to sideload and install third party app stores must be accompanied by parallel legislation that effectively takes the App Store's privacy policies and codifies them as law, and potentially even criminalizes abuse of platforms to gain personal information without the user's explicit consent.