You're entirely correct because JIT requires violating Write xor Execute security policy. This is the reason on iOS, it is limited to Apple shipped software.

https://en.wikipedia.org/wiki/W%5EX

No, it isn't. JITs don't grant capabilities abilities an equivalent interpreter doesn't already have.

Allowing code execution allows code execution, that's it, that's the entirety of it.

So what, are you willing to go away from von-neumann architecture where instructions are data and data are instructions, i.e. the instruction-data hominocity that underpins JIT compilation? Are you willing to go to a pseudo-Harvard architecture where the ability of JIT compiling is soft locked by other means like VM or strong code authentication or policy protection, which is what Apple is doing.

Fun fact: even Apple themselves have JIT. JavaScriptCore on iOS has JIT, it's just that the App Store policies forbid any application submissions with JIT or trying to mmap/mprotect an executable region. There used to be apps on TrollStore that runs JIT

Maybe, but surely there are users who are willing to trust all users of their db instance.

It is the core of ClickHouse for example, for many years. Is it secure enough in your opinion?

In rust, is jit equivalent to an "unsafe" block ?

Machine code is insecure, we should all run interpreted code in a formally verified interpreter.

Alternatively, only allow for the execution of cryptographly signed static linked binaries, this naturally includes the interpreter above.