It really depends on what the application does. It's only really a problem if it's internet-facing, and even then, the harm is limited to the application's own permission set. I don't really care if someone can chain together zero-day exploits to "pwn" my lightbulbs.

A lot of the recent major exploits like php2shell require a fair amount of effort to use, so unless you're a major public figure or holding on to something very valuable, there's not a lot of reason to be concerned.

Obviously, if you're writing a password manager, it's a very different story and I'd be horrified by such a policy there. But you've got to make an argument that this specific app is actually a target