Many of the things you're listing are the exact things the platforms would have to be banned from doing by the regulation you're proposing because they're the mechanisms used to exclude competitors.
If you put all apps in a sandbox then they can't perform certain operations (e.g. install other apps) which inherently means they can't compete in the market for doing those things. If apps have to be signed by the platform then the signing fee becomes the vig they charge to everyone even if they're using a competing store, and both that and scanning/fingerprinting provide a mechanism to revoke competing apps under arbitrary pretexts and otherwise grief their developers and users.
Attestation is the thing you would have to ban the most because it's not just subject to abuse, its very mechanism of operation is to prevent existing apps that use it from running on a competing new system at the point in time when the new system has too few users for all the apps to explicitly add support for it, thereby preventing the competitor from getting enough users for that to ever happen.
But attestation doesn't prevent grandma from getting scammed anyway. When the scammer calls pretending to be the grandchild who needs money for an emergency, they use the official signed bank app on the attestation-passing device to transfer money to the scammer. When the scammer is using a fake bank app to steal the user's credentials, the fake app doesn't require attestation.
The actual problem here is that you want to have someone vetting apps for grandma, but you don't want the platforms to be able to insist it be them rather than F-Droid or Aurora etc. Which the platforms will try to claim is chicken and egg (how do you know you can trust F-Droid?) while hoping you don't notice that they don't actually get you out of it -- how do you know you can trust Google?