This is also not true for add-ons (for desktop/mobile or FirefoxOS), these are packaged as zip files and can't be arbitrarily changed.
However, there is the problem however of the app or add-on downloading and running code from the internet unchecked, which is probably intractable to do in an automated way (at least for the current APIs exposed, and for a dynamic language like JS), manual review is required.
Mozilla requires manual review, and Apple disallows interpreters. I'm not sure what if anything Google does about this problem for Android.