Apple knows how entitlements work and scan every release you try to upload for distribution. The app bundle is signed with an Apple signing key when it goes live, so you can't just randomly change the file once it is on the device.

Evidently Apple does not know how they work, as their multiple parsers can’t get them right ;)

If their scan included an XML parser with the same flaw as CFPropertyListCreateWithData, then yes you could get it published without them noticing.

Apple tracks every time you change it and manually reviews it. In even more sophisticated means after what Uber did.

Note that Uber was given that entitlement by Apple. It was explicitly granted an exception to use a private entitlement (which is in of itself unusual) and then submit such an app to the App Store.

Apple's XML parsers apparently are not catching this due to the comment trick.

So the security relies on a human catching it. There are many ways to hide text from a human, IE padding it out with whitespace, character encoding tricks, etc.