Even if the application is "delivered", it can still be evil.

What's missing is clear attribution of which "app" created the window.