It's a feature to me that I can't accidentally download an (potentially hostile) app from a (potentially hostile) app store, but a bug.
I don't really understand this point. It is not like Android implementation of side load is insecure.
As a user, you need to explicitly enable it in settings. After Android 8 I think, each application that tries to install a application is blocked first and need an explicitly permission too. Even with all that, you still need to explicitly consent installation and upgrade of any sideloaded application. Nothing is automatic.
Comments
I don't really understand this point. It is not like Android implementation of side load is insecure.
As a user, you need to explicitly enable it in settings. After Android 8 I think, each application that tries to install a application is blocked first and need an explicitly permission too. Even with all that, you still need to explicitly consent installation and upgrade of any sideloaded application. Nothing is automatic.