If "skirting Apple privacy rules" amounts to opening a web link, then it absolutely is Apple's fault. If Apple provided SFNextPaymentsInformationExporter, and a

If "skirting Apple privacy rules" amounts to opening a web link, then it absolutely is Apple's fault. If Apple provided SFNextPaymentsInformationExporter, and a malicious app used that nefariously, and then the app was approved, that's entirely on Apple. If Apple wants to advertise security and privacy, as well as enforcing App reviews, then I consider that to be enough to hold them accountable if they fail their advertised promise. Apple did not respond by removing the offending app from their store either.