Apple does a pretty bad job here too. The difference is is that their sandboxing model is better.

Apple does not let you back out an update you made and regret.

Apple does not block apps from using the network or give you any way to find out what they are doing and who they are talking to.

In fact, apple does the opposite - it blocks apps that let you firewall your phone.

Applications like Charles [1] allow you monitor network connections and data closely. Apple do not actively prevent this.

You can also setup a VPN to route traffic and strictly firewall.

[1] https://www.charlesproxy.com

Charles must have some wild carveout from apple. All other apps that do that have been shut down. I still run a very old version of adblockios that starts a vpn (proxy) at 127.0.0.1 and blocks traffic that way. mostly.

I think the parental control app Circle does something similar (faux-vpn proxy). When I tried using Circle, it seemed a bit convoluted to me, so we ended up uninstalling it. So, I’m not sure how unique this method is. But, I’m not sure I can think of another way for a network blocking/security app to work on iOS.

https://firewalla.com is another one.

This works as long as the app does not enforce certificate pinning. But if it does, there's no way to override it and inspect what's actually going on, as I can on my desktop.

Charles is great, but it can't view the data for any app running pinned certificates.