This doesn't use an exploit in Android and instead runs payloads with the permissions of the app. The same can happen on iOS and very likely does in many apps but is reported less often because there is no economic incentive (the App Store doesn't allow antivirus services). For an example, see how Xcodeghost went unnoticed by Apple.

So can you somehow load external (from a file or network, etc.) executable code into memory on iOS now? Last I checked, that was not possible, no way to even map executable pages in memory.

XcodeGhost was a compromised compiler suite. See https://en.wikipedia.org/wiki/XcodeGhost#Attack_vector

The code does not need to be native, JavaScript works just fine (which is exactly what was used in the click-fraud thingy from a few months ago)