I suppose that’s all true, I’d say more “following apples lead on locking things down” than over engineered, but 🍅🍅.

I find myself avoiding the whole root business, I do want my mobile device to be fairly locked down. But I also use alternative OSs and app stores to avoid 90% of the garbage (stuff I can’t avoid I put in work profile, like I still need google maps).

It works for me, but on the front of this complexity driving away devs I don’t really see a viable alternative. Base Linux isn’t secure enough for what we put on these little computers. I mean you’ve still got tons of influential people arguing you shouldn’t use secureboot or a tpm as if leaving your whole computer unsecured is better than the indignity of using a non-free bios.