Just thinking, when setting up new apps, maybe "Only visible to the following users and groups" should be the default?
Just thinking with multi-admins, it's currently too easy to click through adding apps that everyone will see unless that default is changed and configured.