> Apps suffer from MUCH bigger security issues than XSS. It depends on the attack surface. However, something like WebBlueTooth has only one-click/tap authoriz

> Apps suffer from MUCH bigger security issues than XSS. It depends on the attack surface. However, something like WebBlueTooth has only one-click/tap authorization protecting it at best against software that is already downloaded and executing. Mis-taps/clicks are trivial. You do not have that with a new application that a website wants you to download. You also tend not to have installed software updated without your consent after you first obtained it (with the trend to use Javascript to add functionality to iOS apps being the glaring exception), but websites can be updated at any time, by both the web developer and by black hats who hack into it.