How else was it supposed to work in this case? The whole point of the story is that Clearview was bypassing Apple's review process by using a signing key meant

How else was it supposed to work in this case? The whole point of the story is that Clearview was bypassing Apple's review process by using a signing key meant for distributing an app _internally_ to distribute the app to third parties outside of the store. Apple couldn't know about the misbehavior prior to disclosure because the whole point was to keep Clearview outside of their review process.