Sorta, the actual browser chrome is provided by the 3rd party but the underlying rendering and JS engine are required to be the OS provided facilities (i.e. Safari)

Apple’s security model is that Apple has to be able to inspect and review all the code you’re app is going to run. There is a special exception for JS provided that you run it though Apple’s interpreter.

Browsers are caught in the crossfire of a much broader rule that applications can not run code that Apple can’t see. They don’t sign anything that allows for arbitrary or semi-arbitrary code to be downloaded externally and run in principle. Apps get around this by using JS but you aren’t, as a rule, supposed to expose native API’s to your JS code.