There use to be an area where marketplace apps had to be approved for sub accounts to see them. This is very useful for granular control of what applications could be used by sub accounts and far more effective than completely turning off their marketplace permissions on each individual user.
No idea why this feature was ever removed but it needs to come back. This is a huge information security risk if people can log in here and install any app they want and also a great way to make sub accounts really messy for marketers trying the manage hundreds of clients.