The security comes from the sandbox, Apple's curation is pretty mediocre and they only remove malware once it's popular or if it's extremely obvious during the short review.

iOS malware authors tend to publish their binaries as unsigned dylibs and don't need Apple ID accounts so they aren't even banned when they're caught. instead they convince other developers to ship it in seperate apps (there are various ways, money, convenient APIs, both in the case of Facebook.)