Mm, kinda. The following hypothetical feels fairly likely within 12 months of 3rd party app stores being mainstream:
(1) App deals with sensitive or linenced content — doesn't matter what, DRM, medical info, private chat, take your pick.
(2) App integrates 3rd party library to look for other apps that might be trying to steal your data and/or record the DRMed stream you're playing. This 3rd party library injects itself at the lowest level possible in order to catch anything injecting itself even lower.
(3) Bug in library (or supply chain attack in the app as a whole) means the phone is now less secure than if the app had not been installed.
The difference from the status quo is, the iOS app store won't let apps root the phone. (IDK if the Android store prevents or allows that).
(I know games aren't "must have" apps, but this has already happened with anti-cheat rootkits. And "has this phone been rooted" software already gets used, but doesn't yet need to preemptively root the phone itself, at least not so far as I've seen).
You're envisaging something like a medical or banking app that is intentionally not on the App Store, but instead requires you to use some other installer?
I guess that's possible, but seems a bit unlikely -- it's just a pretty big barrier to entry for your users.
Android technically allows this already, but how many major apps are not on the Play Store? (Apart from Samsung apps, which is slightly different case as their store is preloaded when you buy the phone. But there won't be a Samsung iOS phone any time soon.)
I think it's likely enough I expect to see it not just happening but also going wrong within 12 months of this change taking effect, assuming 3rd party app stores are not also regulated to actively prevent that (which they may well be). There is also this anecdote of basically this problem happening on desktops: https://news.ycombinator.com/item?id=32166035
(1) App deals with sensitive or linenced content — doesn't matter what, DRM, medical info, private chat, take your pick.
(2) App integrates 3rd party library to look for other apps that might be trying to steal your data and/or record the DRMed stream you're playing. This 3rd party library injects itself at the lowest level possible in order to catch anything injecting itself even lower.
(3) Bug in library (or supply chain attack in the app as a whole) means the phone is now less secure than if the app had not been installed.
The difference from the status quo is, the iOS app store won't let apps root the phone. (IDK if the Android store prevents or allows that).
(I know games aren't "must have" apps, but this has already happened with anti-cheat rootkits. And "has this phone been rooted" software already gets used, but doesn't yet need to preemptively root the phone itself, at least not so far as I've seen).