Was reading somewhere that you're free to do on the fly updates of any interpreted code - so JavaScript is fine. Only compiled code can't be updated on the fly.

And in react native only the main framework is compiled, with the actual application running in a JS interpreter. So unless we upgrade the RN version, or start using a new SDK etc there will never be a reason to go through the App Store.

All interpreted code is sandboxed anyway, so there's no security risks involved.