Definitely crossed my mind. It'd be easy enough to submit a legitimate app and then modify the content it serves to be something malicious. No idea if/when a follow up review might catch that outside of user reporting.

But in the scenario where apple decides to no longer allow OTA updates, you're just back to the extended review process that native apps have to go through, so I think the productivity gains make it worthwhile.