The thing is, there already is a flow to enable “unknown sources” with the appropriate scare messages. So whatever “advanced flow” they’re going to come up with is going to be more involved than that.

My guess would be something similar to the bootloader unlock flow, where it resets the device and sets it to some “unsafe” state similar to a rooted/unlocked device which banking apps etc. can detect and refuse to work with.