I don’t know about the heat aspect, but third party flashlight apps are just using the camera API without showing you a viewfinder or exposing shutter controls.
Even the built-in flashlight toggles on Android are still just creating a camera session and enabling the flash.
To block third party flashlight apps, manufacturers would have to block third party camera apps too, or add in some sort of global time limit for the flash.