This is the hard question.
What in the world could possibly be enough to where enabling sideloading is ONLY possible by the owner of the device, and not just someone who looked over your shoulder for an hour and saw you type in your passcode+Apple ID, and has now swiped your phone to install spyware that utilizes a 0-day to hide itself from you?
Do you worry about that with your MacBook or Windows laptop?
Is it an attack vector? Sure...I guess. Is it a reasonable reason to disallow sideloading apps? Absolutely not.
I own a mac and love it, but if Apple ever attempts to lock it down the way they have the iPhone/iPad, myself and many others will leave that ecosystem forever.
but my boomer mother? whewwwwwwwwww if someone told her she had to install a 3rd party app store to see pictures of her friend's birthday cake or some terrible grape salad recipe, she'd do it. and she'd give them all of her personal info too.
sadly this is the norm, not the exception