Might it be possible to attach an application to the email then craft a link along the lines of file://localhost/maildir/malicious.ilk to allow installation without a server?

Security is a bit of a tradeoff, innit? As far as I can tell, "security" in telephone handsets is invariably handled in such a ham-fisted way that it roughly translates to "you don't own this." Being able to do stuff that wasn't pre-approved by the manufacturer or the telco requires finding a security hole. That's how people got by the restrictions on the Andriod G1, right? And the iPhone, of course? Certainly, that's the only way I could disable the ridiculous, cat-scaring shutter-sound on my Symbian phone.

The take-home message appears to be that "secure" is synonymous with "crippled." Seems to me that there are only so many ways that story can end.