electron777 I guess you just can't have that kind of freedom without sacrificing some of the security. Although I agree with the spirit of your proposal: give us the tools to securely implement changes to the OS, without us needing to become an OS developer.
Mobile OSes are all about taking control away from the user. Maybe because most users don't know what they are doing and are easily coerced into doing something stupid. Maybe because it's a business model protecting someone else's revenue.
Hell, I wasn't aware of the security implications of unlocking a bootloader and rooting an OS when I first did it! Not even in the slightest. The only thing I knew was I was getting rid of those annoying ads everywhere, which was a REAL concern to me.
Luckily that doesn't require rooting anymore these days. But still, why can't we access app's files and edit their databases? Why are they allowed to keep our data hostage? Why can't we grant or deny an app any permission we want? Why aren't we able to remove the spyware that comes preloaded on our devices? How come Meta gets to run code on my device with system app privileges but I don't? Why is rooting or jailbreaking even a thing? What happened to elevated privileges, to the administrator or root account we know from desktop OSes?
Mobile OSes are like dictatorial regimes, taking away our freedoms in the name of security and protecting us from criminals. The sad reality is that most users and their data must be protected, with so much scammers/malware around and devices always connected to the internet. Maybe it's real difficult—or even impossible—to achieve that while also giving power users a level of access that fits their skill level and risk tolerance.
But it's undeniable that profit is also a factor. Don't tell me having Meta services run as a privileged system app and the owner of the phone not being able to disable or uninstall it is good for security. Don't tell me not being able to deny an app internet access is good for security. Luckily these are some things GrapheneOS fixes, as they actually are about security, without making compromises for year-over-year growth.
I do wish they—or any custom Android firmware—would add a proper way to backup and restore app data. At any time, not just when first setting up a user. And in an open, accessible format too, so we actually own our data. Of course that creates new attack surface, if only for social engineering attacks. There's always a trade-off to be made between security and usability. But it's sad the only choice we currently have is to just burn a gaping hole in the security model—i.e. root the OS—to achieve it. And that most "custom ROM" users and developers seem fine with that. “Just install Magisk if you want that functionality...”
There is room in the custom firmware scene or mobile OS space for a security conscious approach to giving power users what they want. Android and iOS are aimed at the tech illiterate masses. The rest of us are left with hacks like rooting/jailbreaking and exploiting developer and device management features. Which get criticized a lot in security circles, but as long as there are no viable alternatives, is that really fair?