Yeah the logic here is seriously lacking. Heartbleed shows that it's entirely possible someone might not find it for over a decade! Or the most recent Apple Bootrom exploit.
I think the difference here is that apps getting uploaded to the app store have static analysis run on them looking for unauthorized calls. Still doesn't rule it out, but adds an extra check to the process.