I agree with you 100%. I think maybe the problem is that the platform vendors think it's too difficult to explain fine-grained access controls to end users, whereas an app store is dead simple to explain. And, as you observe, an app store makes money whereas ACLs do not.
Much better is a genuine permissions system that the user controls and the apps can't circumvent.
The reason closed app stores are so popular isn't because of security but because everyone wants a finger in that sweet 30% take pie.