Then the corollary is that viruses can't be stopped, because there's no "don't install viruses" API call? Apple can absolutely make API changes to prevent trac

Then the corollary is that viruses can't be stopped, because there's no "don't install viruses" API call? Apple can absolutely make API changes to prevent tracking. They could implement DNS blocking as part of the DNS lookup API. They could add a toggle that requires the user to whitelist any network connections. They could do analysis and provide users reports of which apps they think are doing tracking, with options to disable whichever feature they think is accomplishing the tracking. They could add temporary grants (i.e. "allow network access for the next 15 seconds"). Hell, Apple doesn't even need it's own app store to threaten Meta. They can blacklist binaries and network connections at the OS layer. Apple likes this setup because they remain the gatekeepers of users, which is extremely profitable.