Would Apple have banned the research app, had it been submitted to the Apple app store? And if so on what basis? The basis for pulling Facebook's enterprise cer

Would Apple have banned the research app, had it been submitted to the Apple app store? And if so on what basis? The basis for pulling Facebook's enterprise cert is that they violated the part of the agreement that says such enterprise apps are for internal use only, while the research app was deployed outside of Facebook to regular users. And to what degree does GDPR require Apple and Google, to take responsibility for the privacy safeguarding of apps in their app stores? Does it only bind the application developer, or does it also bind the distributor?