> Then an app wanting undue authority would have to incur the pain of getting users to install it in a special unusual way.

Isn't that similar to getting people used to installing anything they find on the web on Windows and just pressing accept for everything?

I'd say a viable system needs to explicitly address special authority and make users are of it as an important thing, but still within the normal course of UX, to keep the distinction meaningful.

The current state of Android is in the other direction: it explicitly addresses authority for many accesses, but they're not fine grain enough; so apps ask for a lot, getting people used to accept early without having a clear idea of what the app will do in the future, making it cheap for the programmer to ask for many accesses.