Apple controls the OS and the sandbox apps run on independently of the source of the app. Facebook would be able to tell users "you have to give us location access or the app won't run", but Apple controls what data is given to the app. Facebook could implement something to track users in the background, but the sandbox still kills/freezes the app as soon you hide it. They could implement some kind of tracking, but again, remember that the app runs in a sandbox and Apple controls that sandbox.

This is why a malware app on an iPhone can only do limited damage. It can't access all files, it can't encrypt the storage, it can't launch a DDoS in the background because the OS doesn't let it run, etc. iOS or Android are not Windows.

If you want to know how it works in practice, look at Android. It has supported sideloading for a long, long time. People do install a lot of crap, but that's from the app store. My parents are really bad with tech and never sideloaded anything.

And there are other layers of security too. If you go to a store, buy a Samsung, a Google Pixel, a OnePlus, Nokia, etc, they all come with Google Services, which includes Google Play Protect... essentially an anti-virus that looks at your apps and flags anything that is known to be malicious.

Are there any downsides? Yes. Are they as bad as some say? The Android example tells us that it doesn't have to be that bad.