Apple doesn't even really try to do this sort of analysis. They do a quick pass to check for private API usage and such, but otherwise app review is all about checking presentation and functionality to make sure you comply with Apple's rules, e.g. making sure you aren't exposing fully-functional web access in a child-rated app, or mentioning the word "Android" anywhere.

This is a common misunderstanding, and it seems to be one that Apple is happy to spread. Whenever the merits of app review are discussed, some people bring up the security advantages of it. But the fact is, there are none, as XcodeGhost demonstrates nicely. iOS's security is due entirely to the strict sandboxing for third-party apps. App review just lets Apple control what kind of content can be in the store.