Right now, most untrusted code runs in the browser's sandbox, and that's great - outside of the realm of fancy 0 days, the damage is limited.

But if downloading apps becomes the norm again (like every online store asking you to get their app and an extra app for a discount program), I expect that socially engineering less technical users into downloading malware will become much easier.