It's really hard to when there's already technical solutions. They could require a process like bootloader unlocking that puts it in "dev" mode for instance

While signing is useful, leaving no escape hatch imo is blatantly predatory

These restrictions already don't apply to something you install over adb, so there's already that. But that still considerably raises the bar for things like apps made by sanctioned entities, for example, most Russian banks.