This kind of misses the point, which is that the user is the weak link in most personal computing security models. You don't need a CVE on Windows to get malwar

This kind of misses the point, which is that the user is the weak link in most personal computing security models. You don't need a CVE on Windows to get malware on the machine; you just need to trick the user into installing your nasty piece of software--perhaps by making it look like something the user wants. The point of the single-source App Store is that the app review creates a line of defense against such trickery, on behalf of the user.