Eh, we’ve seen many footholds of documented chains start in application code throughout time.

To list a few: - WebKit (CVE-2016-4657) - WhatsApp (CVE-2019-3568) - Chrome (CVE-2021-38003)

Then, also the distinction between platform vs application gets fuzzy with bugs in PassKit etc.