So have a buried option that power users can flip one time to add an allow button to opening untrusted apps.

Bingo. I know I would.

I am the king of knowing immediately when I have fucked up.

“Undo” has made us far too comfortable with mistakes.

they could do it like they do it for accessibility settings. you have to opt in for an app and you need to know damn well if it is a reputable app before giving those controls over. there's enough friction in that that it is not done by many apps but not hard enough that it's a huge ask to whitelist the app.