They can do that for apps because apps are compiled and submitted. The expressly do not allow for dynamic code execution within apps to keep functionality from changing after their review.
That cannot be "just replicate"d for javascript extensions.
That cannot be "just replicate"d for javascript extensions.
This is false too. If extensions aren't allowed to communicate with the internet and can't auto-update themselves, then they also can't run arbitrary code without the user's consent.
This is false. You can deploy a react native app with dynamic code downloading and execution to the apple app store.