If you read their requirements you can infer why they’re doing this: security. They absolutely do not want users’ phones hacked by a 3rd party browser bug. Nor do they want a 3rd party browser phoning home with user data.
Absolutely the last thing they want is Facebook shipping their app as a browser which bypasses all of Apple’s privacy protections.
Apps are sandboxed, but WebKit runs outside the sandbox with additional privileges such as JIT and multiple processes and communicates with the app through IPC. This change is allowing third-party code to also run with these privileges as long as they follow certain security standards.
iMessage has also been the main source of hacks for iPhones for years if not decades. Apple really struggle with securing iMessage.
It definitely does not need to run all the time, it could be woken up by incoming notification like all other apps (and I hope it is how it actually works).
There's still app reviews? If Facebook really did ship as a browser, they could just reject it. Just like they reject everything else that goes against their (unwritten) rules.
The alt stores discussion is really <1% of users that'll use it and I don't think is an issue (but anyway, they are policing that too)
Even if someone got unsigned machine code execution on V8's or SpiderMonkey's JIT, the same could happen on JavaScript Core. All browsers could be vulnerable to something like this (it's just a matter of time before a vulnerability appears), and Apple should be focusing on securing their app sandbox.
In terms of privacy and third party apps, isn't the protection domain name based? Those are native apps, so browser protection wouldn't work.
I’d say nowadays it’s 30% for privacy/security reasons and 70% for profit.
Phoning home with user data does not require any browser engine, this has happened many times. Weather apps were selling gps data of their users (and some probably still are).
(1) chrome has a better security record than Safari so they are not protecting users by disallowing it. in fact they're doing the opposite. Preventing users from using more secure broswers
(2) the privacy protections are already circumvented in current WebView based browsers. How do you think Firefox iOS is able to sync all your history?
Arguably they're doing it to prevent any erosion of their native app market. other browsers provide more features like full screen support and PWA support, both of which are ways of providing app experiences that don't go throu apple's cash cow $$$$$ store
Do you have a source for (1)? I see a lot more CVEs for (desktop) Chrome than for (any) Safari. Also, a native version of Chrome doesn't exist yet on iOS, so how can you say it has a better security record?
Absolutely the last thing they want is Facebook shipping their app as a browser which bypasses all of Apple’s privacy protections.