Apple can just revoke the certificate of developers that sign malware, preventing them from running. They also have the ability to pull apps from your device, but have never used it.