No, take an example of a 2FA mandatory authentication for a bank transaction, security taken care at userspace.

Security at the userspace level should be taken care of by the company behind the apps.

Tone it down. Do you still want to be nurtured by the big corporations like them being your mommy? A solution is already out there, it is called secure boot. Google has unnecessarily convoluted the boot chain, and even the OS VM.

Do you think UEFI on a smartphone is a bad idea?

Also, the Android VM is not even necessary, it just makes development cumbersome, cross-platform compatibility worse, and I could go on.

Security should not control us, we should control security. In other words, this is not the right solution.