I'm not sure the reasons you listed, "X during the review process and then doing Y when in use or obfuscating their use of private APIs", are the best match for

I'm not sure the reasons you listed, "X during the review process and then doing Y when in use or obfuscating their use of private APIs", are the best match for blocking all arbitrary code execution. E.g., there's no reason an app can't simply compile multiple use cases into a single binary to get past review (in fact, this happens all the time). And, it's way too broad to be about blocking access to private APIs, e.g., they're blocking all running of Ruby, Python, Node, etc... with this rule. I think the more specific match to what Apple is blocking with these rules is anything that resembles an App Store-like experience. Apple doesn't want anything that can download and run arbitrary apps, because that would dilute their platform control and other advantages. There's an excellent piece about why Apple is so afraid of this (https://stratechery.com/2013/why-doesnt-apple-enable-sustainable-businesses-on-the-app-store/ https://stratechery.com/2013/why-doesnt-apple-enable-sustain...). This motivation provides a more specific match to preventing arbitrary code execution: An App Store-like experience is almost impossible without downloading and executing code. It also matches the exception that Apple provides for "educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes" (https://developer.apple.com/app-store/review/guidelines/#2.5.2 https://developer.apple.com/app-store/review/guidelines/#2.5...). Furthermore, this perspective is support by other policies as well: 1. This is why Apple doesn't allow third-party web rendering engines on the App Store. A third-party web engine could also be used to create an App Store-like experience. 2. See 4.2.7 (https://developer.apple.com/app-store/review/guidelines/#4.2.7 https://developer.apple.com/app-store/review/guidelines/#4.2...), the rules around what remote desktop apps can do. These restrictions seem specifically written to prevent remote desktop features from being used to create an App Store-like experience. So, while I think rule 2.4.2 does help with the goals you listed, if it were just about those goals, these rules would be written differently (e.g., allowing downloading and executing scripting languages). And I think there's more evidence that rule 2.4.2 is more about preventing third-parties from providing App Store-like experiences.