That's going to end up the same way as Android if I have to guess yeah, as complicated as it gets for a normal user to activate so that nobody uses this outside of tech workers.
Then they can just say that it's technically "there" for the courts.
Then they can just say that it's technically "there" for the courts.
Sandboxing and app distribution are two concept which might or might not be linked depending on the implementation.
For example, if somebody implemented an appstore for WindowsXP which had zero software protection, the appstore would have been a significant vector of distributing malware as well.