I should have been more clear. I was using Tim Cook's statement as an analogy for flashing/side-loading. Allowing good guys to do it means bad guys can do it to

I should have been more clear. I was using Tim Cook's statement as an analogy for flashing/side-loading. Allowing good guys to do it means bad guys can do it too. Tricking a user into side-loading malware does not require physical access to the device and is relatively common on the Android side (more so on third-party stores).