It does give them enviable control, but the security is a valid point. A browser engine has a wide surface area for attack vectors as it features multiple parsers and a JS engine.
It's taken from the same playbook as their refusal to support open video codecs in WebRTC. Apple is the new IBM, using money and market share to keep out challengers. If Steve Jobs were getting started today we'd have a picture of him standing in front of the Apple logo giving it the finger.
