Regulating the fees for one central app store is no solution.
Oh boy, now my mom can get the full experience of having malware on her phone too!
The other problem consideration here is negotiating power.
Today consumers don't have negotiating power over individual developers, but both Apple and Google do. If you complain to Meta about their unwanted tracking, you don't really have many options besides deleting the app (which you should do anyway). But if enough people complain to Apple or Google, they are more inclined to do something and have the power.
While it may be a marriage of convenience, it's undeniable that both companies through their app distribution models have also provided benefits to consumers that developers otherwise would have abused - privacy, screen recording, malicious advertising, &c.
If you want to argue from the standpoint of pro-consumer action, you have to remember that "developers" are usually pretty awful too and will get away with anything they can, even if it harms their customers. A good balance, instead of ideological purity about one "side" or the other is the smarter move. I tend to come down on the side of the mainstream app stores precisely because those asking for more "freedom" to do as they wish are a tiny minority and are usually more technical. I.e. they can jump through the hoops to install 3rd party app stores and jailbreak their phones today, and since you already can do what you want, maybe it's best to just leave the masses alone since they're very obviously happy with the duopoly.
Digital goods DO NOT work like physical goods. I can just buy another washing machine. I CANNOT just choose to opt out of using a smartphone. My choices are apple or Google, and even within those choices it's limited by network effects.
I think the principle of digital autonomy should be front and center. Surely we can figure out security models that don't imply that two American tech companies get to call the shots on what people can or cannot do on hardware that they supposedly own.
If Google Play Integrity didn't exist, the app would only be certified to run on e.g. unrooted Samsung Knox devices.
The technical security requirements should not be hard to define, i.e. the platform on which the solution runs should require all keys to be device-bound with a certificate chain from the hardware manufacturer proving this to the issuers during enrollment. The operating system should also be able to verify to the issuer that the hash of the app is recognized as an official app.
However, the strongest integrity level of solutions like Play Integrity - which is the only level that GrapheneOS cannot pass, and which only my national identity app requires - is protecting against very theoretical attacks which I don't believe actually happen in the real world, since it not only protects against fake malicious identity apps, but also against the scenario where a scammer has convinced their target of installing a custom Android operating system which fakes the app integrity verification. This attack requires a victim with a technical aptitude that allows them to unlock the bootloader and use adb, but which is at the same time gullible enough to believe the attacker. It also requires that the attacker builds a malicious Android release for the exact hardware of the victim. Seriously, if the victim is this easy to manipulate and also this resourceful, then the attacker should just convince them to disable biometrics and send the phone to the attacker by mail.
It is very very clever of Google to disguise what is essentially voluntary vendor lock-in as a security feature.
If you go all the way to "everyone should have the freedom to get pwned", then you are also funneling the money of innocents into the pockets of some of the worst people in the world, and that's not a great outcome just to make life more convient for some HNers.
The question is about what trade-off makes sense for most people. That probably is some sort of escape hatch nontech people just won't do.
Maybe it's a hard thing to appreciate until you've watched aging family members get tricked by absolute scum, mostly enabled by how loosey-goosey modern computing can still be.
Of course thats PR argument, in reality its about distorting and manipulating the market to get the most money out of its users and bind them to their ecosystem as hard as possible to extract even more. And the amount of those same people who uncritically defend them here is still staggering. But maybe its just employees ignoring their ndas, some investors and similar folks.