They are already familiar with how to run a comprehensive review of apps. They could just replicate that for extensions.
That cannot be "just replicate"d for javascript extensions.
This is false too. If extensions aren't allowed to communicate with the internet and can't auto-update themselves, then they also can't run arbitrary code without the user's consent.
This is false. You can deploy a react native app with dynamic code downloading and execution to the apple app store.