If only it were even just the apps. Check out this blog post by the Tor project and look at what it takes simply securing the OS:

https://blog.torproject.org/blog/mission-impossible-hardenin...

Of particular interest to me was how the captive portal detection reports back to Google everywhere you connect even if everything else is disabled.