>and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps.

How do you determine/enforce whether an app is a "payment app" without a centralized developer program? They don't require any special privileges. After all, most banking apps have web equivalents.