App Store rules are only enforced when it's convenient for Apple or their partners.
> 4.5.4 Push Notifications must not be required for the app to function, and should not be used to send sensitive personal or confidential information. Push Notifications should not be used for promotions or direct marketing purposes unless customers have explicitly opted in to receive them via consent language displayed in your app's UI, and you provide a method in your app for a user to opt out from receiving such messages. Abuse of these services may result in revocation of your privileges.
From: https://www.imore.com/apples-updated-developer-guidelines-no...
We need something like the CAN-SPAM (which as for emails) to classify transactional vs marketing/engagement notifications and a way to levy fines on violations.