I manage my own domain and create aliases for each online account I create.
I do a very similar thing with my email domain, using both aliases and catchall. And I get tons of spam in my catch-all to made-up addresses. Lots of the same ones over and over. Eventually I create aliases for the largest offenders and route those to a particular mailbox I hope fills up and stops receiving.
The most infuriating was when PayPal accounts (spit!) started getting opened to addresses in my domain. No way anyone can receive those to complete the registration validations. Well, no way I think, without considerable infrastructure compromise. Or unless my email provider is compromised. Or unless I am well and truly pwned . . . I did immediately change my passwords to the service.
Worse still was when a couple of those eventually got activated by PayPal after they seemingly relented on the repeated validation requests. That's when I had enough and reached out to PayPal "support". Needless to say they were not responsive. Few agents could even make out what I was describing. Once I finally escalated to someone with half a brain, they still claimed "Oh those are only PARTLY activated. They still can't send or receive payments without linking a bank account." No apology for how/why they got activated in the first place. They were totally unconcerned. I eventually did a password recovery on one of them, logged in, and found a name and address in another city in my state. I couldn't verify that it did have a bank account associated. So maybe the PayPal security guy was not totally lying. But what a cavalier attitude toward financial security!
Most closed source apps do things we would call malware if a PC program would do them
Exactly. Except even many open-source apps also use libraries from providers like Google. At least if it's open-source, then people (in principal) can know what's there. Though in practice that only indirectly and partially protects the vast number of users of open-source software who are not themselves developers. Like me using apps such as Notepad++ - I trust it by reputation, but I don't really know what's in it.
And the majority of users of phone apps are even less likely to be capable of inspecting the software they use. Instead we tend to just trust it more because it's open-source.
That said you could of course also build ethical ad frameworks. But with all the app developers not reading the fineprint, you can make more money by dropping the ethical part and still having developers choose your framework.
And this could easily be NO PROBLEM provided government fulfilled its mandate "to promote the common welfare" and regulated business fairly, to protect us from this kind of abuse. But (at least) since the 1980's the mantra in government has been "Don't stand in the way of Business". With a capital 'B' because Business is what we worship now. Government has been captured by the rent-seeking capital moneyed elite.
As Thomas Picketty demonstrated always tends to happen over the long term. (See Capital in the 21st Century
"How many teamsters does it take to screw in a light bulb?" "FIFTEEN!! YOU GOT A PROBLEM WITH THAT?"