Let's say someone submits a malicious keyboard with the bad instructions hidden in a constant pool. Apple can't just scan for a bad byte sequence in executable

Let's say someone submits a malicious keyboard with the bad instructions hidden in a constant pool. Apple can't just scan for a bad byte sequence in executable pages because it could also represent legitimate constants used by the program. (not sure if this part is correct?) If so, doesn't that make detection via static analysis infeasible unless LLVM is patched to avoid writing bad byte sequences in constant pools? Otherwise they have to risk rejecting some small number of non-malicious binaries, which might be OK, depending on the likelihood of it happening.