Well this might stop some malware, but what stops to push app with some kind of VM(or browser view) that load remote code and later update it to something else?