Sadly the present state of software engineering is mostly incapable of archieving what your reasonable expectation is. Malware can exploit bugs in the devices to get arbitrary code execution (=run any code the attacker wants).