To exploit this you only have to infect one of the many dependencies off user installed app. It is not true that the attacker has to forge an identity in the Ap

To exploit this you only have to infect one of the many dependencies off user installed app. It is not true that the attacker has to forge an identity in the App Store. It is enough to insert your code somewhere along the whole software supply chain. And that can be long, think about ReactNative apps using NPM dependencies.