Apps can have vulnerabilities (intentional or not). It's a contrived example, but maybe some weather app has a custom icon feature, which means you can then browse photos by opening it on the lock screen and going to that setting.
Widgets are just apps with limited scope and surface area. There’s no reason they can’t apply this to the weather app which already has (or should have) a limited scope.