Not allowing arbitrary code on a platform is hardly an irrelevant point. It's a fundamental architectural decision that makes deep statements about what a platf

Not allowing arbitrary code on a platform is hardly an irrelevant point. It's a fundamental architectural decision that makes deep statements about what a platform can do, and who has permission to do it. These decisions define both business models AND features such as user security and trustworthiness. For instance, to be competitive in terms of performance, a browser almost certainly needs to JIT Javascript. If a platform prevents apps from generating code and enabling the 'X' bit in PTEs then this isn't going to work. Even if the platform provides JIT services (e.g., pass in an AST, out pops a few pages of callable code) there is still a ton of added risk. Designing and maintaining the security of a platform is a ton of work and a big investment (assuming it's done well). Security teams are already quite busy, and adding whole app categories that are suddenly able to break previously established design decisions is not easy -- "just do a security audit on a handful of titles" is a phrase that we've all heard, many times, and it sends shivers down our spines. Having seen it tried, and been on some projects that did it, I think it's impossible to do well even at a small scale. Been there, done that, seen projects canceled because PMs couldn't internalize the nature of the risk to the platform.