The problem is, the App Store conflates security review with "curating". The question, whether "Hey" offers in-app purchases or not is not a security question, the app was rejected because Apple requires in-app purchases (from which they take 30%).