This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or

This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or in specialized sandboxes like ARM's TrustZone. This is about moving that to instead be in a VM on the "primary" CPU, implemented in open source Linux kernel code instead of who-knows-what ARM microcode. Or to compare against an ecosystem that has more love around here, imagine if everything that Apple runs on the T2 was instead run in a VM with an equivalent level of security. That's the goal.