If I download the example.com app then any tracking is limited to what they included either themselves or through an SDK. I know that $random_advertiser doesn’t get to execute their own code.
You either trust them, or you don't. If you don't trust the ad-networks they embed in their site then you don't trust them.
> If I download the example.com app then any tracking is limited to what they included either themselves or through an SDK.
You either trust them, or you don't. If you decide you trust the ad-networks they embed in their site then you can trust them.
Both are no different. Other than that you can evaluate the first quite easily but not the latter.
My point is that it is silly to trust someone from including advertising and tracking on one platform (binary-app) but not when they do the exact same on another (html-app).
The website operator/publisher is the one choosing to track you (or not). Not some magic third party.
If you don't trust example.com from tracking you, you certainly cannot trust example.App from tracking you.
For web, the technology is at least transparant and you can detect being tracked. With native apps, there is nothing you can do, other than reverse engineering the binaries, monitoring internet-traffic and hoping that example.App was built with privacy in mind.