I think of "apps" on nostr as clients or services that can be run like nodes. Tens of thousands of nerds can all run iris, Primal,  nostr dot cooking or whatever. 

Governments might be able to take down iris, but everyone with a Start 9 or umbrel can run their own iris.

DNS is the biggest vulnerability right now, not clients or relays getting censored. I also think holepunch has the potential to fix this.