That's why App Review exists – Apple could theoretically only give this ability to select apps that apply for it. They do this currently with "Network Extension

That's why App Review exists – Apple could theoretically only give this ability to select apps that apply for it. They do this currently with "Network Extensions", for the ability to write a custom VPN plugin because it involves giving a third party app access to all network traffic from the device. There are always good compromises to solve these problems when you maintain 100% control over your software.