Perhaps not even that is completely safe long term, as companies can introduce a locked down dependency, reverse policies (see Google's recent sideloading stance), or find some other workarounds.