See Anywhere and Replit. Anywhere was the #1 or #2 app and was taken off the app store entirely before being put on and then taken off again.
Last I checked, Replit hasn't received an update on the iOS app store in over two months due to reviews denying them.
But it's more likely it's just walled garden + security theatre that'll keep them from allowing outside apps.
With a canonical source of truth, and set input/output expectations, the potential blast radius is quite small.
I don't think that's necessarily true. For instance, LinkedIn uses more memory than Gemma E2B inference does.