You're not getting an official GNU repo if Apple still takes a cut. They'd only set one up on their terms, which Apple is chronically incapable of cooperating with.
The _moment_ there's an option, there will be a Facebook store, and it will have things like that vpn app that routed all traffic through Facebook so that they could do analytics on it. There will be cross app device/user level identifiers.
Facebook will drive something like 10-50% of people to add their store if it's the only way they can have their insta/whatsapp/fb/whateverthehellelse.
Google will probably roll out a play store as well. I don't think they're going to be as overtly evil, but they're still going to be be going around Apple's privacy protections if at all possible. (Why not? I get the feeling that FB is more on the back foot with metaverse and other flat/failing metrics, and google has more to drive people to them between Chrome, Android, and GApps.)
And others? There will probably be at least 10-100 app stores, and I would be shocked if there wasn't one that attempted to do things like a hidden RAT/Rootkit. I'm not saying that the app store review process solves a malware problem, but it is one layer in a defense in depth. It certainly has kept my extended family's devices in better shape than their computers, which I've had to clean occasionally.
This is a version of good of the many vs good of the few (Sorry, been looking at Star Trek lately). On the one hand, there are companies that would like a bigger hit of the pie, + a fringe of people who have enough knowledge and skills to manage to manually setup a secure phone with alternative/os/apps. On the other, there's Apple and a vast swath of humanity where the iPhone/iPad is probably the most secure computing device they can hope to own, and is yet still useful.
I dunno. Maybe Apple could allow stores on their phones, but still take a % of any purchases, to annoy EPIC and their ilk into buggering off.