I think the selective memory is not just mine... f.lux was working on iOS in 2011. Sure, they used a private API not allowed in appstore, but it worked fine - a whole 5 years before Apple released its copycat version.

As for the browser: dynamic code execution is a red herring - there are plenty of runtimes like python available on the appstore, and they execute all sorts of crap just fine. Modern browser engines are sandboxed so hard, they are equivalent to (or better than) anything you find in an OS. The security angle nowadays is just a flimsy excuse to keep Safari (the IE6 of our times) from becoming utterly irrelevant overnight.