[S&P 2026]Convenience at a Cost: The Security Risks of Template-based Development in the App-in-App Ecosystem