Yes, there is trust involved, but the user gets to determine who they trust, not the manufacturer. That's actually the core issue here.
Again I re-iterate, any app downloaded from anywhere (whether it's the App Store, an external app marketplace, or an install from Github) will be sandboxed by iOS, and in order to reach through that sandbox to access things like camera roll, calendar, contacts, the local network, health data, Bluetooth, WiFi, GPS location, an OS-controlled dialogue must be interacted with by the user, an app can't just skip asking, the APIs won't return any data if the user hasn't approved access to it.
And they will, via code signing certificates provided by big names like DigiCert, VeriSign, etc., or Apples notarisation process. The App Store isn't the only way to facilitate that.