> A signed app is only more secure if they load absolutely no code remotely

Which they don't. That's why it's not a web app.