> setting unchangeable except by an administrator account

Part of the regulation appears to require third-party apps to have the ability to use any APIs. Therefore, any malicious app will be able to present system dialogs that are (possibly) indistinguishable from official OS dialogs. This seems bad.