NCSC calls on tech firms to tackle rogue apps, but has the ‘horse already bolted’?