Also, just saw this (see below), another example of JS injection using CodePush (by MSFT) and RN, Apple seems to fine with this....doesn't this have them same security issue?
1 karma · joined March 14, 2017
Even w/o hybrid platform, developers today are loading js assets remotely, and basically inject new code - All THE TIME.
what Apple did is just flagging the ones that are most upfront about it, but everyone can do it, hence the rollout suggestion IMHO