Few processes in practice are 100% effective. One, or a even few, failures does not indict the idea of curation, but rather, in my mind at least, reinforces its value.
Of course, as others have mentioned, software protections of the Address Book would be nice, and are coming (though I'm not sure they would have stopped this app from doing its thing).
Whether that trade-off is worth it is a completely different question (I think it is not – Apple should allow users to install whatever they want, they can even make enabling that needlessly complicated, but they should allow it.) but if you are immediately jumping to the conclusion that Apple’s curated approach is devoid of value because one piece of malware made it through your analysis of the situation is lacking and populist.
It seems to be 'scaling' just fine.