App Store review can be random, AND this can be a good policy. (Well, good for consumers. I could see it causing developers some issues if competitors weaponize it.)
When I download a package from f-droid repository, I know the folks at f-droid have the source code of the bits I downloaded. Same thing with Debian and Fedora. Why can't Apple do the same thing? Require developers to submit machine-readable source code along with build instructions. Build them directly on Apple servers. Sign them with Apple's certificates.
I am not an Apple developer. As a consumer, I would welcome such a change.
Now, it is true that you could have a web view that fetches application chrome/content from a web server but I would argue Apple should disallow such apps anyway.