> The only way I can think of squaring this circle is for Apple to sell two different SKUs of every iPhone: one that can sideload (and allow apps such as alternate app store apps to install other apps), and one that cannot. Then users can choose their overall security model once at time of purchase.

Well, no, the Android model for unlocking the bootloader works well here - just make it awkward enough that a typical user can't do it without jumping through a few hoops.