> what prevents a person from hooking up their phone to a development HTTPS proxy, intercepting the API requests, and making their own cracked client without side-loading at all?

SSL pinning, essentially.

Totally true about Android--it's the smaller platform for us, but the fact we have not seen piracy there yet gives me hope.

To be clear I am in favor of sideloading, and we would benefit from it in several ways.