Sorry if this is obvious - how is this different from the Google Play store?
Note that the permissions system, app signing (with any key as long as it's the same for subsequent versions of the app) and other safety features are built into the system so they still work the same - security it not dependent on the Play Store.
"Google does it too" isn't a valid defense if it does turn out Apple is found to have done something wrong.