Silly question, but how does WeChat get around this? Does custom code for Official Accounts just work on Tencent's server and basically work in a WebView?
I suppose the custom code is just custom JavaScript code. It has always been possible to execute arbitrary JavaScript code, including those downloaded remotely. No WebView needed.