Except that as discussed, there are plenty of code execution flaws in mobile builds of webkit that will do just as well as any flaw in the native app API.

One XSS or SQL injection vuln in your webapp and your users could be just as rooted as the victims of this malware. Exactly like in the desktop browser world.