They're locked down through technological measures such as sandboxing, which is designed to resist against malicious guests regardless of their origin and distribution method.