At least at this point, antitrust regulation hasn't prevented Apple from removing apps from its store that violate its policies. I don't see how it would be any different if they created a penalty short of removal that's only applied to bad actors with a history of needing it. This is needed for more than just Facebook's stuff, it could also apply to trojan privacy invaders like the Weather Channel app.

They could slow walk updates as they do unusually thorough privacy audits, and perhaps even apply extra access restrictions (e.g. skewing location, forbid use of certain permissions, etc).