That would work for things like accessing a user’s address book or location but some of the quality control occurs at the App Store review level.

I don’t think iOS would be capable of protecting against, for example, the running of hidden cryptocurrency software.

Also iOS has private api’s but their use is prevented by the review process.