Also, just saw this (see below), another example of JS injection using CodePush (by MSFT) and RN, Apple seems to fine with this....doesn't this have them same security issue?

https://blog.bugsnag.com/react-native-plus-code-push/