Well yes, but this is a game streaming app. It just captures input from the user and sends back a video of the game, running in the cloud.
> It's a private company and they can do what they want.
And we are individuals who can complain as much as we want; this is a non-argument.
> I appreciate their oversight, because now I know that I can't get hacked by Microsoft allowing bad games on their app!
The games are totally isolated from your phone, so they can't hack you, unless they're somehow using the input from your phone as a ridiculously low-bandwidth side channel.
I'm just spit-balling here. These are the top attack vectors that come to mind. IDK, maybe I'm thinking wayyyyy outta the box here.