The app will essentially be the same thing, with a different library. I don't think there's a need to keep an old branch since I'm just migrating the app, not rewriting.
It's not securely sandboxed like a Qube, but apps can have their permission to access files and such restricted. Malware can escape the sandbox, or apps may come with very permissive permissions.