Hacker News Reader

This isn't really a hole. This has existed forever. Apps could always embed webviews and load files from the local filesystem.

You weren't allowed to update over the wire until last year. The JavaScript carve out is particularly important.

You could, and still are, able to download html/javascript/css to the phone, and then load those files in a web view.