I dont really have the time to participate in what looks like an interesting debate but I have a few notes on your post.
How do you expect to attempt to secure that many devices by allowing the platform to continue as it was?
Secure what? Against what type of threat? This type of vague question results in vague answers. If the threat is social engineering I would argue not many protection would be effective beside educating the user about that.
You call it dumbing down, which I understand, but how do you stop all the click-happy people from installing the next nefarious "game", when they already have little to no chance to avoid email spam and SMS scams, let alone LLM generated "custom targeted" exploits.
You don't stop them. You ask them and show them a disclaimer when they activate sideloading and that's it. They are on their own. If the user doesn't understand the risk after (skipping) the disclaimer. That's their own fault. I don't want to be put in prison just to make sure nothing bad ever happen to me. If a user purposefully disable protections they are on their own. But they should always be able to disable them.
I get that there are users who use this (now) vanishing functionality, but are they representative of the total user base, or edge cases? Neither you nor I have any hard data on that, but I know that as an ICT professional, I'm an outlier.
This is the openness of the OG Android. Welcoming as many users as possible even if they are not your mean average user. It doesn't matter if these user are a minority. They should be able to override any security they want. As long as they have acknowledged that they understand the risk and will not sue Google for it. I don't see the problem.
I have worked on a custom ROM based on AOSP and that's the other trend that worries me. The fact that less and less of "Android" seems to go to AOSP was already a concern years ago. Google wants to close their OS to better compete with Apple. This means severing those annoying minority power users from the rest of the community.
I see a very paradoxical response from you coming from Linux. If you enjoy Linux for its openness why would you accept Google rhetoric like that is really surprising. Let users do complicated stuff on your software as long as they have signed a virtual "I AM IN DANGER" form that's OK. If you remove these advanced settings features anyway then it's not for the user, it's a PR move to protect the perception of your software.
Sorry if this comment seems a bit aggressive. In my opinion you are arguing for Android to slowly transform into IOS and ad someone working on Linux for decades, this is very weird.