Apple libraries use private APIs but developers must not use them directly. If you allow developers to execute arbitrary bytes, they can submit app which does not call private API but will be able to call them later after approve. JavaScript is safe, because it can't call C API, but arbitrary JIT engine is not.