There should be a way to battle this outside technical measures, like a crowdsourced group of real distributed humans testing apps for anything malicious.
You can detect both the triggered behavior and "hey this looks like a logic bomb" with static analysis. Yes, you'll never trigger this with some dynamic analysis of the app. But "hey, some code that does things associated with malicious or otherwise bad behavior is guarded behind branches that check for specific responses from the app developer's server" is often enough to raise your eyebrows at something.
But that would probably require some actual human code review, which costs $$s.
Apple could offload that to the developer in the form of review surcharges.
You'd find a code pattern that was being used, and declare it suspicious.
Rinse and repeat, as people are still going to try getting around the rules.
Eventually you're left with some weird subset of a subset of a language that's legal to write iOS apps in.
It’s a common fallacy to assume infinite worlds result in every possible world but 1, 10, 100, … is an infinite series but is only covering ~0% of possibilities.
Though that's another story, targeted attacks will always find a way to slip through.
This method can protect the general public a bit more compared to the current "screening".
I guarantee they would get sued/attacked into oblivion, within a year or two. Look at what happens to Krebs. He gets SWATted, all the time.
They would need some good backing, and have to be subject to fairly stringent controls, themselves.
You see that stuff all the time, with even officially-sanctioned enforcement agencies. Amateurs won't have a chance.