Apple never sufficiently instruments code during app review; the curation doesn't actually prevent malware, it just lets them remove it once it's well known. I

Apple never sufficiently instruments code during app review; the curation doesn't actually prevent malware, it just lets them remove it once it's well known. If this weren't the case you wouldn't hear about people sneaking behavior apple doesn't like into published apps.