It depends on the feature. For things that involve material changes to your app or a feature that you don't want Apple to be surprised about, usually you will include user credentials in your submission that have that feature enabled and give them a heads up. If's a smallish feature, you don't usually sweat app review. It's obviously not a perfect system.

You provide Apple with login details when you submit your application. Just enable all the features in advance for Apple’s test account.

I'm pretty sure that's what Fortnite did right before they got kicked out of the App Store.

Before my company implemented IAP in a few of our apps we did the same thing, but decided the risk was too great. Getting rejected is one thing, but getting your account terminated is obviously a much bigger deal.

You are supposed to list all the feature flags and explain how to enable them in your review notes.