While I'll agree with your second point about designing the API in a more safe way, the first one I'm not as sure about. You could make that same argument in favor of malware authors against Big Bad Microsoft walling them out with new Windows Defender definitions.

If something is stealing my personal information and sending it off to advertisers, I'm entirely happy to have the OS vendor give them the boot.