Post author here. I've also been in various DMA enforcement workshops and consulted with EU regulators on the topic of app distribution. The "strictly necessary and proportionate measures to … not endanger the integrity of the hardware or operating system" defense comes up time and time again, and is clearly a primary talking point for those lobbying against effective enforcement.

From a developer's perspective, this stipulation is obviously intended to ensure that the existing on-device protections (sandboxing, entitlement enforcement, signature checks, etc) are not permitted to be circumvented by third-party app stores. But the anti-DMA brigades have twisted their interpretation to imply that that gatekeepers are permitted to ... keep on gatekeeping.

Apple still requires that all software be funneled through its app review (they call it "notarization", but it is the exact same thing as review: developer fees and T's&C's, arbitrary review delays, blocking apps based on policy, etc.) before it is signed, encrypted, and re-distributed to third party marketplaces like AltStore. And now Google is going to introduce its own new gatekeeping for all software on Android-certified devices, which covers 95%+ of all Android devices outside of China.

The lack of alarm has been, for me, quite alarming. Every piece of software installed on billions of mobile devices around the world is going to be gate-kept by two US companies headquartered 10 miles away from each other and with increasingly authoritarian-friendly leadership.

If you have an Android device, install F-Droid today and make it be known that you won't give up your right to free software without a fight.