I wonder if a "parent lock" type of measure but for external installs could work, basically allowing a user to disable the external installations (and other things) unless you enter a custom code.

For those of us who know enough there is no need to enable it.

For those that are not as technological (like elders), a familiar/friend can enable it and no matter what they try, they can't "harm" the device without asking you first.

The only ones not getting any benefit are non technological people without technological contacts, but even in those cases I'm sure shops would gladly provide that support (like the usual "setup support)