This isn't a free or safe choose one scenario. As a platform owner Apple could offer a vetting service for known-safe popular applications, make those easy to install, and create a clear scare-screen when enabling installation from other sources, as well as management profile settings for disabling unvetted or 3rd party app installation all together. Then the only education anyone needs is to not install unvetted apps.
As a bonus, they could make the app curation system extendable, so other groups could run vetting programs. By default your device would only have Apple as a trusted vetter, but as part of a management profile or something you could also trust apps vetter by some security research group, or Epic, or Valve, or whoever. That way security isn't all-or-nothing.
And of course, if anything slips through and your layman user OKs all the warnings and installs a malicious app, it's still operating in a sandbox, and can't do much more harm than clicking a shady link and ending up on a scam website can.