App Store review can only do minimum security level check in reality. And actually there's not much they can do either. Let me give you 3 examples: 1) Hybrid a

App Store review can only do minimum security level check in reality. And actually there's not much they can do either. Let me give you 3 examples: 1) Hybrid apps that most contents are actually webpage, such as the tripadvisor app and at&t app at some point (not sure if it's still hybrid today) 2) Games. You can load new code as static files or contents, then the app parse and execute the code as a new update. This is quite common in mobile games. As games require frequent update like once or more per week, it's really an unwanted workaround to fulfill the update frequency requirement. 3) Do you remember/know the case recently that some hacker released a "poisoned" version of xcode and apps written by that xcode "automatically" contains code sending user info to that hacker?