Most apps don't need access to all web sites, they just need access to specific services. If the developer of the app controls some or all of those services, then the app can be coded to require the use of OV/EV certificates. With that rule in place, the app can then also inspect the subject DNs and check for the presence of its own organization details. The end result would be kind of like certificate pinning, except a little more flexible.
For documents, yes this includes things like DocuSign, but also signed PDFs, signed XML, etc. Any situation where a business, nonprofit, government agency, etc., is corporately attesting to something, like the signing of a contract or the public release of a statement, can use an OV/EV certificate.