TestFlight builds to my knowledge only have to pass the automated scan. As such, as long as the dev isn’t using private APIs or doing other forbidden things that can be statically scanned for, it’ll get past that point.