Even though I don't like that approach, the best option (as some others mention) is to have a device installation flag that allows/denies all third party things

Even though I don't like that approach, the best option (as some others mention) is to have a device installation flag that allows/denies all third party things. When you buy an iPhone it will be off, and no matter what you do you won't be able to turn it on so you can "give it to your grandpa without fear". But for those that want, just allow reinstalling iOS (a full installation, deleting existing data) with the flag enabled. And just like that you can do whatever you want with your device, and "accepting the risks" of doing so. What if your grandpa is tricked into enabling it? Well, all the data will be deleted so there will be nothing to steal. Bought a used iPhone with the flag but still want the "security"? Just reinstall without it and done.