For FirefoxOS "hosted" apps this is true, but they also don't have access to any significant APIs. Only "packaged" apps do. This is also not true for add-ons (

For FirefoxOS "hosted" apps this is true, but they also don't have access to any significant APIs. Only "packaged" apps do. This is also not true for add-ons (for desktop/mobile or FirefoxOS), these are packaged as zip files and can't be arbitrarily changed. However, there is the problem however of the app or add-on downloading and running code from the internet unchecked, which is probably intractable to do in an automated way (at least for the current APIs exposed, and for a dynamic language like JS), manual review is required. Mozilla requires manual review, and Apple disallows interpreters. I'm not sure what if anything Google does about this problem for Android.