Google (+ apple) Control their mobile platforms and take responsibility for apps served through their respective stores. Why can't they do the same with their

Google (+ apple) Control their mobile platforms and take responsibility for apps served through their respective stores. Why can't they do the same with their ad networks? Transpile any JS code served from their network into a safe execution environment/api that only permits the resources allowed safely?