> the WebView is fully "owned" by the app, so the developers can inject arbitrary code into the DOM of the third party website

Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server).

I would've made the same suggestion to a 3rd party app vendor when the day comes.