I think it depends on the app and the entitlements. I would assume apps that request entitlements for system-level VPN apis are scrutinized more than calculators.
Apple doesn't review apps the way people think it does.
The real goal of the review process is to maintain control over the UX, not prevent malware. If you want to see a review process that stops malware read a Linux distribution mailing list.