I'm looking at this from Android, as that's the initial target and discussion here. If I download an app from Google's app store, I have some confidence that the app is well behaved and has been checked for obvious malware... But if the app depends on remote code that can change when it likes, how can I ever be confident in using that app and granting it permissions?