This is funny because by far the most impactful breaches of security on iOS phones have been due to the Apple components, like the messaging app that inexplicably is still written in ObjectiveC as it's ever been, or the image framework found to contain various bits of opensource code they never updated, never audited, or the various terrible magic "serialization" features.

This Apple native crud they force every app to use (up to the whole browser engine, like in the IE days!) is truly the ActiveX of our times. Only you can't even get rid of it.