Its a bit harder to exploit, but this is also a problem with mobile apps. The developer could be compelled to release an update which leaks data to a 3rd party for specific users. Even for opensource projects there's no guarantee that the published version of the app matches anything in the commit history. And I doubt anybody looks inside the binaries that get published to the app stores when there's source code available.

So right now on web or mobile you simply have to trust the app developers.

Apple & Google could easily fix this by copying the docker registry. Just run a build process themselves directly from a specified git SHA. Publish that & name the repo & git SHA they used for the build. That way security researchers could go read the sourcecode and know that its the actual code running on everyone's phones.

Mind you, doing this would make it easier for the US government to compel apple or google to modify a binary for just one user. But apple and google can already do that if they want to.

Another approach would be to make the whole toolchain build reproducible binaries, so a researcher can run the build process themselves and verify the binary hashes match.

But lets not pretend that somehow apps are more secure because you download a sandboxed app from an app store instead of sandboxed JS + HTML. The tech stacks used to deploy code are more similar than they are different.