>The bar to run a custom OS is already so high for average people that it will never matter or be a social engineering attack vector

>We've been able to run anything on PCs for over 40 years

And the PC platform has had terrible security. Do not use it as an example of everything being fine. You are forgetting the malware for PCs which would spread by writing a custom operating system on a removal media. Then that removable media is plugged into another PC and when that PC boots up it boots that operating system which goes ahead and infects the OS installed to the hard disk along with any other removable media.