Actually we don't provision separate VM for each app, and they run in a shared environment with other Apps, so if the access is given to execute their code and if the code is consuming good CPU/RAM, then it can bring-down/affect other apps as well. Hence not seeing the option for them to execute their code.
But yes, if they want to write their code, they can always use AWS Lambda or similar services to execute their code and make an API call to pull/push the data from there and use them in the app by connecting it to that code via APIs.