It's not always that simple. What if I make an app that asks for some data from you "for it to function", and then posts that data to somewhere it shouldn't, there's not a lot to be done about that from an OS enforcement perspective.