Do you run 1p and 3p code in the same environment? That’s frequently the challenge mobile operators run into - the OS needs privileged access to location services (eg 911) that it can’t grant untrusted code.
It doesn't actually need this. The phone app can just ask for permission to access your location, which you would then give it when you call 911 because you want the emergency responders to know where you are.
Anyone who really wants to can already deny the phone their location by using a Faraday cage with a WiFi access point in it so the phone has internet but no GPS or cellular triangulation. You can't prevent it by not allowing the user to deny the permission.
There is no excuse for special permissions.
For example, Apple Music should not have privileged access to location services - it should be using the exact same location APIs and permissions as 3p apps.
> Every app delivered on this store must go through the same review process whether it's internally built or not
Believe it or not, but internal Apps go through an even more stringent review as they have Apple branding. The exception is they're allowed various privileges that wouldn't be appropriate for 3p apps (security or even that a framework isn't quite ready for prime time & needs some bake time with internal users for whom back compat isn't a concern).