What you don't take into consideration here is that if you get an app as given, your security is already busted. Regardless of what the platform is.

If you install any random binary-only application to your device you will grant it at least user-level system access to your device, in some cases even root-level access. (and for most systems it is enough to have user-level access as there are new privilige escalation holes all the time...)

The only possible safe way is that the service provider publishes a sane API and the applications using it are provided in source form to be compiled by oneself. Binary distribution can be allowed if the sources are available and mechanism for reproducible build verification exists.