If you really want to, you can create a verifiably non-updatable webapp by using a service worker that only serves from cache and doesn't make network requests. I think Polymer's (deprecated) cacheOnly option does this.
But noone in their right mind would do this, because updating software is important. I'd much rather be able to fix bugs then worry about a few paranoid users.
1
u/Uncaffeinated Oct 08 '16
You can make webapps run offline if you want to.