I think he meant it's invulnerable if httpd (the "app") isn't running.

In the context of web applications, would it make sense to stop using the word "app" to refer to software/daemons available in the distribution repositories, and instead only use "app" to mean the products and services built on the former?

app == application == executable computer code