That's the whole point - the average user should be able to run code from random third party developers only in a sandbox. Preventing security issues requires

That's the whole point - the average user should be able to run code from random third party developers only in a sandbox. Preventing security issues requires imposing additional limitations, you can't have your cake and eat it too. Either the apps require serious review (i.e. a much, much higher bar of entry than iOS AppStore), or the apps need to be restricted so that they can't do much, so strict sandboxing. Running unsigned, unsandboxed binaries from a small developer is a big security risk which can't be prevented in a cost-effective manner, so average users have to be warned that it might as well just encrypt their files for ransom.