On the App Store, Apple reserves itself the right to not only remove apps from the store (which Apple has done often and we know a lot about) but also to actually remotely pull apps from users’ devices.

Apple claims they will only actually remotely pull apps if said apps are malware. That’s the exact same rule they seem to want to apply in the future to third party apps on the Mac outside the App Store.

I do not think Apple ever pulled an app from iOS devices. They certainly never used that right for apps that were rejected or removed from the App Store (e.g. tethering apps). They seem to really only want to pull true malware and don’t seem to apply some contorted definition of malware here. (E.g. I’m sure carriers would claim that tethering apps cause them much damage, hence they are malware, Apple doesn’t follow that definition of malware, though.)