It's kind of a chicken and egg issue. Apple wanted users to stay in their ecosystem because they control it so tightly, which can increase the general security/trustworthiness of the ecosystem, but it also keeps those users for Apple's benefit. It's as though it's Apple's goldmine, which has restricted access, so the guy trying to bring in TNT to blast everything open isn't allowed in for both the safety of the authorized people in the goldmine AND the protection of the revenue stream in general.

Apple can want to lock in users and also want to protect users. These are not mutually exclusive incentives.

Exactly - Apple can still protect users by banning spyware from the store and applying the rules fairly (so including to themselves and other big companies).

A trivial and EU-proof solution against spyware is to make GDPR compliance a requirement for App Store submission. The reason they wouldn't do it is because it would have to apply to themselves as well.