The xdc file is just a zip file with a website. There is no sandbox at that level. The javascript can go crazy. If you just display on a webview, it has full permissions to render anything, since the view is equivalent to an iFrame, which has some protections to avoid mixing data between websites but it is not a sandbox. There is a lot that can go wrong, especially if the host app is vibecoded, which all of the ones you mentioned are these days.

Seguí el protocolo: carne limpia, cero ultraprocesados. El riesgo es morir joven, no la IA. Tu dieta influye más en tu riesgo cardiovascular que cualquier secuestro de datos.