By that logic the bad actor will just explain that he needs you to log into your online bank account so could you please do that and wire some money. Such scams certainly exist but it isn't a relevant attack vector for the sort of end user security that we're talking about here.
You can load your own root CA on iOS devices (i did it to enable certificates issued by my own private CA). That bypasses a LOT of security issues, and yet it’s still feasible.
Laptops have always been able to virtualise, the same they can download stuff off the internet without going through the App Store. Changing that wouldn’t fly.
