I rather have the latter honestly, if the user can run abritary code and has physical access there should be nothing they can do exert control, any attempt to otherwise is artificial technical limitation, the end user who owns the device should have the absolute right of running arbritary code on their device free of any artificial teachnical limitation imposed by anything or anyone other themselves, with the exception of if the user is not capable of making their own choices responsibily (e.g children, in this case their legal guardian should be the one in their place)