> the market will eventually reflect and account for that in the future.
Which won't help unless we're willing to break apart duopolies and enforce government antitrust. The point I'm making is that when you get rid of consumers' ability to solve their own problems, they lose the ability to solve their own problems.
They don't magically get that ability back when the market starts being terrible. Take a look at Amazon's DRM -- it doesn't matter if you as a consumer wake up one day and realize that there are negative consequences to being unable to port your library to any other devices. You still can't do it.
Market capture is not a problem that can be solved by the market on its own, which we've seen repeatedly throughout the history of US markets, including in the computing market.
This is why we have regulations around some of the most egregious anti-free-market activities companies can take. For example, it's illegal to use warranties to block unrelated consumer repairs. Car makers are legally required to use some universal interfaces that allow non-manufacturers to repair and alter the vehicle. And we're currently campaigning to get rid of DMCA restrictions on breaking DRM for legal purposes like porting Kindle books to other platforms. None of that is stuff that consumers on their own would prioritize, but they're market conditions that benefit everyone tremendously. These are instances where the free market can't solve the problem on its own, there have to be legislative changes that allow the market to compete.
And unless you're currently buying stock in Purism or Windows Phone, I think we both know that the current smartphone market is not set up to allow competition.
> which users happily and quickly disabled to allow malicious programs that they didn't really evaluate at all
So what makes you think they didn't? You're assuming that consumers are making a rational choice when they purchase a phone, but not when they use the phone. I don't think people's brains stop working when they turn their devices on, I think that we should apply a consistent framework to understand both people's computing usage and their purchasing decisions.
> Knowing when to disable security guardrails, however, requires actual security knowledge
No, it really doesn't. You can have a big warning that says "this makes your phone insecure" and people don't need to know the details to trust you.
Of course, in practice, people ignore those warnings. But there's two ways to interpret that -- either people don't understand security/access at all and we shouldn't treat any of their purchasing decisions on this with reverence, or people are making a security decision not to trust phone manufactures when they uncheck that box, and we shouldn't shame them for having a different risk model than us.
I object to any attempt to try and characterize them as somehow being both conscious/unconscious of the risks at the same time, there has to be some consistency in how we talk about those people. How do you know that normal users don't just have a separate threat model than you and that they're willing to uncheck that box because they're consciously deciding to tolerate a greater rate of infection/malware than you find acceptable?