My point is that these are all things which analytics apis (which, mind you, are also arguably malware) at the time did as well - reading the clipboard was common as many operated their own internal clipboard proxy due to the slowness of pasting in older iOS versions. It's only called malware and not Facebook because it was injected into developers' apps without their knowledge.

And the 'remotely controlled via commands' section is meaningless - apps can't JIT so such C&C was simply turning flags on-and-off to go on different code paths.