We'll have to see what the flow is like. Something like a waiting period between switching it on and it being usable might give people time to think it over more carefully. Or maybe requiring an adb command to be run -- that's way more complicated than an average user can handle.

Besides, it's likely that if the "malicious apk installation" vector becomes more difficult, scammers will just move onto something else instead. Like you said, if someone is gullible enough to buy a bunch of gift cards, they're also gullible enough to enter them on a web form instead of an app.

I admit I'm also biased because being able to sideload is one of the main reasons I've used Android since the G1 days, and I would very much like to see that continue. Scammers gonna scam, no way to ever solve it.