So you're saying in order for them to be secure you need to basically build a browser into the app. Since I have basically nothing in my app that requires trust would it even make sense for me to do it especially if it causes bloat?

Not only build a browser in the app, but run it as a separate process from the OS, so that memory is fully separated from the app by the OS. Which means you have to create a way to render things in one program and send that image to another program to be displayed in the feed via some type of data bus. In that way, the OS can make that process offline without requiring the entire app to be offline. Similarly, the OS can manage permissions for that process regardless of the permissions granted to the app.