Apple absolutely does treat the web as an endpoint that needs discriminatory features to protect users. See tighter controls of: 1. location data 2. notificat

Apple absolutely does treat the web as an endpoint that needs discriminatory features to protect users. See tighter controls of: 1. location data 2. notifications 3. long term state 4. background processing 5. photo access 6. web access on local network 7. sensor access (e.g. accelerometer) 8. state sharing with other parties (e.g. 3rd party cookies) There is no regulatory body that can apply economic penalties to security and privacy abuses on the open web. The App Store model on the other hand requires a real identity verification to sign up as a developer, static applications which can be verified by review, and real penalties for abuses (refusing to publish new versions, removal from the store, potential legal action by Apple for contract violation). As an example - an API for reading the personal contacts database can only have a gate for access with no limits on abuse once access is granted. The App Store model lets Apple apply real penalties for abusive behaviors of such an API. The web does not have a regulator, so the hypothetical UX for sharing a contact is designed to be much more restrictive with a higher barrier of user consent.