I don't think this would be trivial either. Given that iOS security has historically been rather good, I guess an attacker would need a reasonably new exploit or even zero day. Assuming an attacker has access to something like that, I'm 99.8% certain he'd be able to sneak past the review process as well.
As Fortnite has demonstrated, it is perfectly possible to sneak past the review process with something as obvious as a third party payment checkout. If something like that is possible, it'd be definitely possible for something like an exploit.
The review process isn't magic
https://arstechnica.com/gadgets/2018/08/fortnites-android-vu...
And at least Epic wasn’t purposefully installing back doors. Unlike Zoom.
https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
Also, I think you may overestimate most attackers. Most of them are so lazy.
I would _love_ a 3rd-party App Store that hosted jailbreak apps/apps that abuse private APIs/etc, so long as it was clear what I was getting.
It's easy to say "well that's just their own fault if they installed something bad," but I don't think Apple really cares to argue with their customers over whose fault something technically was. Apple just wants their customers to have phones that are working well.
A sandbox that can be trivially bypassed is simply broken.
Granted, it's not easy to define what apps should and shouldn't be able to do within the sandbox. Permissions systems are difficult to get right. But whatever the rules are, they must be enforceable.
That's basically what Epic did.
There are many things that go wrong with the App Store, but you have to realise this is a ludicrous assertion. Pasting from clipboard is an entirely different class than rootkits, backdoors, trojans, and other malware that have a vanishingly small chance to go through the review process itself.
This is defence in depth. The sandbox helps, but it’s not magic. Without review, publishing an app with a sandbox bypass, or simply abusing entitlements, becomes trivial.