Right now, if I was running some open source OS on an open source hardware, with random 3rd party unverified apps, etc. - I would have no confidence in myself to keep that thing secure.
I agree that things like openssh can be more secure because there is a huge number of individuals and corporations using it, there are a lot of eyes on it. It is open source and secure.
That's not the same as something as big as an iPhone. iPhone is an ecosystem of apps, cloud data, biometrics, hardware encryption (secure enclave), etc. and finally the physical device.
For some reason a lot dev's cannot seem to comprehend that a lot of people(Including myself) are not capable/wish to maintain/keep up with security.
I rather use my brain cycles for something else. This is compounded for people who have no interest in tech but rather just want to use them to perform certain tasks.
Are some of practices unfair sometimes to a small subset of companies/developers. Definitely yes, But what are the other options that have this level of privacy or trust worthiness with a similar ease of use/setup. I don't know of any.
My guess is just beliefs. It's pretty similar to what happens in code at-least where i work at.
Dev tries to make it super flexible, tries to make it fancy, implement DRY like one's life is dependent on it ultimately resulting in a hard to read/maintain messed up spaghetti code.
Also i don't see how can a person know all of the security stuff with a beast like Android unless they spent/are willing to spend an insane amount of time on keeping up latest exploits, architecture etc.
But there could be a switch to allow installing apps from untrusted sources" default off. It's sad that people are so ignorant and gave apple so much power. :(
I think you're over-generalizing. Most people with an iPhone do not care about side-loading apps. They may be ignorant, but they also do not care. The same reason I am ignorant about the rules of NBA, or Cricket - I simply do not care.
The power you're talking about (and the risk you're not talking about) are of no value to me.
For what it's worth, I agree with you. I work in software and the number of times I have inspected the source of something I'm running could be counted on one hand. I trust Apple, I trust the open-source community to look for me, etc.