You need to look at this from a practical standpoint.
The vast majority of phone apps are not local-only. They are merely the frontend to services provided by some company - e.g. a Reddit app is really about Reddit the service, a food delivery app is about the service, not the locally running code, etc.
Apple controls what users can and cannot install on devices made by them, but the web and things like PWA are an alternative that would be viable for some portion of these.
You can make a web app that can be added as an icon on the homescreen, can access the camera, location, notifications, storage, authentication (e.g. require fingerprint), etc. It still can't do everything native apps can do, but it would be good enough for a good portion of popular apps.
But in China, that is not really possible without the government's approval either, because China requires the same kind of registration and an ICP license for websites, otherwise things will get blocked. Which, even if you could install anything you want on a device, would effectively limit you to purely local-only apps anyway.
I still see fake download button ads distributed via Google's own ad infrastructure to this day. I even reported a few that were taken down.
For all the AI prowess Google likes to brag about, why can't they make a simple "does this look like a download button?" detector? The scams are not that clever, most of them follow one of a small number of specific patterns.