There is an easy solution to this: Allow the user to decide whether they want to allow for apps from outside a particular ecosystem. Then Johnny can set up Grandma's phone and (in a deep byzantine menu where she will never accidentally stumble on it, maybe locked behind a pin), Johnny can set it so that Granny's phone can only install software from "Super premium, high class, curated, guaranteed not to hack your phone" walled garden app store. And Johnny, on his own phone, can choose what to download himself, including from the "Buyer Beware, half our shit is malware" dark web app store.

In my opinion, the Apple app store should actually be FAR more curated than it is, and far less curated options should be equally available. The Apple App store (and the Google app store for that matter), should be a relatively small list of apps that have extremely high standards and guarantees. It should essentially be impossible for spammy bullshit to get into these places. User-controlled, parental control like options should determine whether or not other app sources can be installed from (including allowing for specific other sources, so that app source control can be granular and detailed. I should be allowed to add FDroid but nothing else for example).

Done. Problem solved. Everyone is happy. Grandma is safe and Johnny has control over his phone.

But of course, that assumes that keeping Granny safe is actually the reason. Facially obviously, it is not, and is in fact entirely pretextual.