You can't trust sandboxed systems either, and honestly, who ever audits the code they run? "Auditing code" is a smart-sounding phrase that is meaningless to 99% of users. Also, have you audited your sandbox's code yet?

I consider mobile apps toys because they're designed to contain and own your data, and that impares both the ergonomy of work and limits your capability for doing things to whatever is available in the MVP some startup released. Most apps don't evolve past the point of MVP.