There's nothing complex and impossible about removing some "if" statements responsible for code signature enforcement.
https://developer.apple.com/documentation/browserenginekit
They needed to engineer, maintain, document and support a whole class of APIs so that third parties can create their own competitive browser engines (that offer JIT, etc) while still maintaining iOS sandbox security. There are going to be hundreds of frameworks, thousands of APIs, that will need to come to ensure compliance with the DMA
Apple has a significant engineering challenge to turn their current operating system into something that allows side-loading similar to what Google offers. It's not a matter of "commenting out an if statement"
The current developer SDKs Apple offers are strongly tied to their services, which cost them money to run. So first thing is, they have to decouple that so developers can implement applications using a baseline SDK that does not use Apple services (no iCloud, no Maps, no HealthKit and so on)
I think it would be great for users if they did do this. It would be akin to what Google does by shipping and updating Play Services separately from the base Android install
The reason I linked BrowserEngineKit is because if you want to do this properly, you have to build something like Apple has built with that framework (which was built to comply with these policies). Take for example, implementing your own JIT: because arm64e uses pointer authentication, the system uses PACs to ensure that pointers into executable code have not been tampered with. Apple now develops and supports a whole slew of APIs like `be_memory_inline_jit_restrict_rwx_to_rw_with_witness()` in order for developers to manage this themselves.
You saying "just let their pocket computers run software users download and install" is not like every single other computer ever made and sold. This is a gross oversimplification of the modern state of computing, both on mobile and on desktop. There are reasons you don't want random developers loading code into your OS kernel, and Windows and macOS both have protections for this (though the CrowdStrike crashes recently shows what happens when those protections are lax!)
For example, I don't think it would fly that they could say to the EU: users who want a third-party browser just have to enable root access and lose access to all Apple services and authentication
Well. I guess they'll have to choose between opening it up like every other company does or acknowledge that it's a separate pay for service then.
They do a lot of that kind of thing and my answer for all of it is the same: Open it up to everyone or acknowledge it's a pay-for cloud service that has nothing to do with the actual phone OS. If people have root they can (and will) develop their own services that won't need that which would comply with the DMA.
Hell, just releasing my own personal code as open source — auditing it, decoupling libraries, removing internal stuff, it's a huge multi-week effort for me to do. For any company with as much code as Apple, it's pretty daunting