The code signing system on iOS doesn't let you dynamically add code to your app. I am also very curious about what "it is a downloader" means - if the architect

The code signing system on iOS doesn't let you dynamically add code to your app. I am also very curious about what "it is a downloader" means - if the architecture of WhatsApp means that it has a built in; externally accessible / triggerable, network capable scripting engine then that is really, really bad. I would be really worried about that app if it is true. [added] The report writer may not have chosen the best way to phrase this. What it might mean is that the investigators believe that the "malicious" payload that compromises WhatsApp is in that part of the message, not in the video. As they weren't able to get that piece, they weren't able work out how the exploit worked.