> there are legitimate cases where it makes sense to not expose the filesystem directly and disallow native apps. This has the benefit of better security.

I always found the better security argument to be a red herring in a school environment and always pushed back against it. If a computer breaks then re-image it. malware spreading? Wonderful! There's an amazing learning opportunity!!

The point is moot at my school now though as all students are required to bring their own device (Mac or PC), and of course they have full control over their own system. As it should be ;)