To clarify, Apple can't see our source code but I imagine they can easily diff things like binary size and have basic decompiler tools to analyze things like what system APIs are called (how they bust you for private API use etc).
When we ship an update that adds a whole new branch of functionality that adds camera/mic interactions where there were none before (with all the new entitlements that requires) and the reviewer approves it without ever launching the app I laugh at comments like the GP