Sure, but at that point we're getting into the weeds of fake webpages, which really isn't anything apple could control anyway. Nothing's to say that if sideloading didn't exist, that page wouldn't just direct them to a form to fill out your banking information. All it does is change the method. Apple could simply maintain a hash database of files that are known as dangerous and package it into a built-in AV for iOS (like most OSes do)

Nothing's also to say that the page wouldn't just abuse one of the hundreds of vulnerabilities that currently exist in WebKit currently.

For your average user, they're probably only visiting legit sites on that browser anyway. My grandparents both have Android phones and to my knowledge have never been "tricked" into installing an APK. I can probably say the same for the vast majority of people.

I believe the benefits outweigh the costs here. Apple loses their grip on the walled garden which is punishing for developers and makes Apple judge, jury and executionor on not only what apps can run on iOS, but also how much developers have to give up to Apple (they could up their cut to 90% at anytime and currently developers can't do shit about it).