So long as browsers allow you to open the developer tools and inspect memory etc., they're more open than remote attestation of a stock android or ios device

Decompiling apps only works if you can get the app. I don't understand GP's problem with the apk format either, but you do need to break terms of service to get the files if you don't have a phone with Google services installed. Whether that's ethical or legal is up for debate