Last time I fiddled with it, was when we moved domains and our webviews stopped working. They i) did not follow the redirects we had in place, and ii) did not allow loading the new URL without whiltelisting that domain/url somewhere in the source-code.

IIRC whitelisting was the default in webviews; not sure if it still is, or if our expert Android dev configured it this way, but even getting a build that allowed to load content from our new domain required a new build. (Let alone that someone, even if we had links or such in our about.html, would be able to navigate there).