It's not the only way to run internal apps: They can also install them through XCode. Also, the revokation was in no way arbitrary, but due to a grave violation of the terms under which the certificate was obtained.