Surely the solution to that is not to have your OS expose "private" APIs that allow abusive behaviour? It's not as if they aren't widely exploited even on the official app store today.

Once again, trying to filter malware at the app store level is not a viable strategy for robust, reliable security, and it never has been.

Presently, security researchers are already finding both major apps doing this on the Apple App Store (Facebook accessing the camera on the News Feed), and spyware apps happening on secondary Android stores (also on the official Play Store). Sounds like an opportunity for more security watchdog businesses.