If the app doesn't have any sensitive information, then yes. We already do this with home screen widgets today, so clearly there's no real barrier.
Apps can have vulnerabilities (intentional or not). It's a contrived example, but maybe some weather app has a custom icon feature, which means you can then browse photos by opening it on the lock screen and going to that setting.
Widgets can't have vulnerabilities?
They can, but scope and features increase surface area: their limited functionality intrinsically limits that.
Widgets are just apps with limited scope and surface area. There’s no reason they can’t apply this to the weather app which already has (or should have) a limited scope.
Camera app does it.
Nope; the lockscreen camera is actually an entirely different app, or not-quite-app thing. (Note what happens when you open the camera roll in the lockscreen camera.)