> or fake empty responses without telling the app.

I thought the value proposition of the walled garden was that no app was malicious so this is a non-issue.