It's entirely possible. The iFit app which runs on my treadmill is an embedded web browser. From "God Mode" there is an iFit Admin app which reports information such as the embedded chromium version being used for iFit.

I actually walked down to the basement to test this - even when closing the iFit app while in God Mode, the physical controls on the treadmill including speed, incline, the stop button and the magnetic safety key, continue to work as designed. If you close the app then you can't see your current speed, but you can still stop the machine.

That being said, I haven't dug into how the iFit app sends commands or retrieve data from the treadmill's controller. It seems possible that a "rogue" app could somehow interfere with this communication or send its own set of commands to throw you off the machine, but feels very unlikely. Plus, the tablet on my treadmill is running Android 7. I'd be much more afraid of remote exploits on the embedded browser on this ancient OS than someone with physical access loading a malicious app.