It's all tempered by them ultimately controlling what you can put on your phone though.
As was demonstrated in LA, it's starting to have significant civil rights consequences.
Security is pointless if platform allows 90% users to be social engineered into running code disabling that security
What happened in LA?