>Just tell her not to enable developer mode

She doesn’t know what that is. She won’t remember what I said 5 minutes after I leave. She will blindly follow the instructions of any official-looking website or any scam caller that instructs her to disable these protections in order to “watch a video” (actually sideload an executable).

> Apple is the master of UX; surely they can figure out a way to keep things secure for users who need it to be?

She got around all of the modern permissions and signing protections on macOS and installed a malicious phony video player that nuked her device and stole her banking credentials. It doesn’t matter what you tell her: she WILL get tricked unless it’s impossible to be tricked.