> It's not about "design", because the iPhone is perfectly capable of running arbitrary code
It is a very intentional UX choice to mitigate malware for users who do not know how to evaluate the legitimacy of software on their own. And studies show that this is a very effective policy, both perceived (e.g. marketing) and real (actual breach statistics).
You can mitigate malware while still allowing for the same level of end-user control as the manufacturer. Look at Windows itself! People getting infected on up-to-date installations is a rarity nowadays, all without draconian lockdown policies.
It took windows many decades to get there and the reputational harm was already done by then. Android is not doing particularly well but it has improved significantly.
It is a very intentional UX choice to mitigate malware for users who do not know how to evaluate the legitimacy of software on their own. And studies show that this is a very effective policy, both perceived (e.g. marketing) and real (actual breach statistics).