I think for the sake of conversation we would have to draw a dividing line between the operating system Apple makes and the apps Apple makes, even when that line can be very, very blurry. (Pre-installed apps, the App Store itself, etc.)

I'm having a hard time with the App Store, both as an example of an app that shows ads and should therefore not be allowed to use the device ID without prompting, but also being the app that manages the apps you run on a device, and therefore might require a device ID to function correctly?

But perhaps the answer is simpler than that, and Apple only needs to keyword-match to show ads in the App Store, no tracking ID required?

Personally, I would solve this dilemma by eliminating App Store ads. Users want the app they searched for, not the app a competitor is paying Apple to promote...