From a factual perspective, it wasn't on the App Store. (It was distributed via an enterprise certificate, which I find to be even worse, since they are explicitly not supposed to be used in the manner that they were.)
IMO, I wouldn’t be surprised if this happened this way cause Apple had decided to use FB as the fall for a PR media blitz. (In particular, Apple made the decision to “enforce on FB” basically the day after their “someone else can turn on your camera with FaceTime without you knowing” bug.)