You don't need root to install arbitrary APKs, and I don't understand #1. How is this any different from, e.g. apt-get? It's just a mechanism for easily obtaining and updating some vetted packages.
Anyone who wants to install a non-Play Store app, can. If you're someone looking at a piece of software on the internet, the application's website can easily offer you instructions on how to download and install their software. This is exactly how Windows has always operated.
A perfect example of this working well on Android is the Amazon Appstore. Disregarding for a second the meta-ness of it being another app market, they do a great job of explaining to the average user how to download their software (by pushing it to them through email, text, etc.), "allow non-Market applications" and install the APK. Sure, not every user is capable of doing this, but I think anyone who has helped non-technical family can attest to the fact that the same is true on Windows.
Windows never had a repository system so devs had to advertise and distribute their .exe's independently, giving the ecosystem that feel of 'open-ness'. But the second you have a semi-curated centralized repository system available like on Ubuntu or Android, the system becomes 'closed' because it effectively creates this 'barrier' you mentioned due to the new convenience. So is there no middle-ground here?