Presumably, if

1. the user is side-loading an app they wrote themselves (or is an internal Apple/Google developer who uploaded an app to their app store and audited the entire sausage-making process as it transpired),

and 2. the app does literally nothing,

then the user can be 100 percent certain that the app does what it does securely.