Citation? AFAIK the iOS sandbox has not been broken on un-jailbroken iOS devices, so at worst you're getting a garbage app that doesn't do what it promises.

I've never seen nor heard of any actual malware outbreak from a non-jailbroken app.

Maybe I should have put malware in quotes. I was generally referring more to the privacy invading, battery sucking, ad displaying, etc behaviors of the vast majority of applications. Which per wikipedia (and traditional usage of the term) makes them malware.

Apple/etc seem to be suck in the mindset of the various antivirus products before the advent of adaware/etc. So the products aren't strictly virus/trojans/worms/etc but they definitely fit the definition of malware and the end results are potentially just as bad. I would actually prefer any number of virus's over the some of the shenanigans the facebook app has been accused of.

I know next to nothing about iOS, so: Why can't the (usually public) jailbrake-exploit or another, similar potent (and probably quite expensive) be launched from inside the app? Sure, it has to be hidden to get into the store, but that looks very easy compared to finding the actually jail break. One just has to hide a arbitrary code execution vuln in the code of the app somewhere.

So, every apps seems to be an attack sureface.

If there was a jailbreak available, yes. But there hasn't been a publicly available untethered jailbreak since March of 2016, and there has never been an untethered jailbreak of iOS 10.

The only jailbreak for iOS 10 was semi-teathered and only made public after Apple had patched the vulnerabilities. In order for this to work as malware the user would have to open the malicious app every time their phone restarts. Not only that, every time the they open the app their phone would appear to be out of storage and then promptly crash to the boot screen. It would be a bit of a hard sell.