Sometimes Apple is aware of vulnerabilities before they are patched, and it only takes getting caught once for the app, company, and individual developer to be banned from the App Store.

Also, I think you may overestimate most attackers. Most of them are so lazy.