We have different definitions of an "escape hatch". A user is not an IT specialist. Ordinary people need unobstructed access to lifeboats.
Apple allows developers to self-sign a handful of apps (exclusively from source!) with short-lived certs - it's a complete PITA to maintain a simple app for personal use, and you still need an account. Google is heading in the same direction.
>>rollca+(OP)
Also features that people assume are part of the OS, like push notifications, but are really a service run by Apple that your phone is locked to using cryptography don't work with self-signed apps.