They don’t need to. They’re perfectly capable to statically analysing an app binary and looking for calls to APIs app aren’t allowed to use, or containing CPU i

They don’t need to. They’re perfectly capable to statically analysing an app binary and looking for calls to APIs app aren’t allowed to use, or containing CPU instructions that are potentially dangerous. We know this because when dev submit apps that call private APIs they get very quick rejection. But hiding private API call behind obfuscated blobs of dynamic code can get you through app review, provided you don’t expose the functionality in your UI. Additionally the modern App Store deployment process involves uploading you app in an intermediate format, only partially compiled, so apple can dynamically recompile your app to target new CPUs, and optimism your app to use new hardware without intervention by the dev.