I dont think Google is as permissive as you say, but regardless, they won’t. Try and get a normie to enable and install a sideloaded app on Android and you will see what I mean.

The amount of social engineering required just makes this point moot. Might as well get them to do the same MDM attack illustrated in this article. Its not any less secure.