This is a lot to unpack. Let me narrow it down here:
- Developers submit app to AppStore
- Apple scans it, manually reviews it, certifies it meets security, privacy, and quality guidelines
- Apple allows users to download the app from the AppStore
- Users assume apps on the AppStore are secure because Apple loudly proclaims this
- Users are infected with malware
And this isn't Apple's fault? Of course this isn’t a tenable position for Apple. There’s no way to catch everything. But they market this, and use it as justification for their walled garden.
This is a valid point, and also the reason this particular attack is so interesting. Apple's system relies on holding people/companies accountable for submitting malware. Apple has the power to knock a company out of the App Store, so the company is incentivized to not push the limits. This hack is an attack directly on this relationship-based system. It's an attack on Apple's ability to punish. This doesn't make Apple's system worthless, just worth less.