How do I protect against the apps having my private key?
Use a nostr remote signer (NIP-46), such as Amber on Android. It will hold your key and apps have to ask it each time they want a signature from your key for an action.
How about for iOS and web?
Check out https://nsec.app for both.