Static code IS arbitrary code. Apple didn't author it and didn't vet it. They ran a static analyzer over it (not remotely foolproof) and then trusted the actual

Static code IS arbitrary code. Apple didn't author it and didn't vet it. They ran a static analyzer over it (not remotely foolproof) and then trusted the actual security to the process sandbox. Besides, nothing stops you from still running arbitrary code in iOS downloaded from the web. You're simply restricted to doing that either interpreted or via Apple's JIT. In either case you're still getting arbitrary execution that Apple never statically analyzed, interacting with any APIs that the app wants that code to have access to (intentionally or not).