Okay so WebKit cannot be used as is, but then why forbid other alternatives [1]? Seems like a Catch-22.

> It seems like an engineering challenge to expose these features to arbitrary 3rd party frameworks in a way that doesn’t allow these features to be abused.

How does literally every single other platform manage this? AFAIK none of Android, Windows, the many Unix-like OSs, even Apple's MacOs have such restrictions on browser apps.

And I think it'd be unfair to characterize the users of those other platforms as being "abused" by their browser apps. E.g. Firefox seems pretty trustworthy.

[1] https://developer.apple.com/app-store/review/guidelines/ - "2.5.6 Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript."

They don’t. All of those platforms are less secure than iOS.

[1] https://www.theregister.com/2020/05/14/zerodium_ios_flaws/

[2] http://zerodium.com/program.html

Do you have a source for this statement, specifically in relation to browsers?

Let's consider Android. I wouldn't automatically assume that using Safari on iOS is more (or less) secure than using Chrome or Firefox on Android - they are all provided by well known tech companies with years of expertise building browsers and a focus on security.

Controlling the execution environment is part of iOS’s defense in depth strategy. Focussing on browsers alone is a red herring. You have to look at the whole system.

It’s true that Google or Mozilla may be able to produce an equivalent level of security in a browser engine, but that’s a false comparison, since alternative browsers are not limited to just these companies.

You can also verify that the world is run by lizard people by googling.

[1] https://en.wikipedia.org/wiki/Firefox_for_iOS