Sandboxing. You do it with sandboxing. A technique that has existed for aeons in computing time.
As far as I am concerned, they should be able to vet anything that goes on their app store, but if a person or business wants to develop something that is for their own use and doesn't need to be published to a "vetted app store" then it shouldn't be blocked.
At most all we need is a mechanism through which we can register and pay a token (geddit?) amount for signing keys for side loading.
That way Apple still weilds a ban hammer of sorts but opens up the platform to private / open development projects. The primary rule being "you can only go through the app store if we vet your app" and everything else is "installed at your own risk and comes with no Apple quality guarantee".
Which means if Apples quality control stacks up, the app store will become the safe "Shangri La" they purport it to be and anything signed with sideloading keys is not their responsibility.
It actually gives them a degree of plausible deniability.
Biting the hand that feeds IT
