From apple.com/privacy:
"Every one of the more than 1.8 million apps on the App Store is required to follow strict privacy guidelines and report how it uses your data. And every app is rigorously reviewed by a team of experts at Apple."
Your private key is used to sign a transaction transfering your bitcoin to our account. We do not share your private key with anyone and it does not leave your phone.
I think it's a given that no one expects any QA or security process to perform perfectly. But there's some fuzzy line past which Apple's process fails to be "rigorous", and whatever that line is (or should be), courts will inevitably contrast the high expectations set by Apple's marketing with these real-world results when considering claims of negligence, liability, false advertising, anti-competitive behavior, etc.
Or in the alternative, Perhaps Apple should create a different tier of app review for any apps which claim to facilitate financial transactions (other than purchases, game currencies and microtransactions). This would encompass all apps for banking, investment and crypto. This tier should require a much higher verification of the developer's identity. The iOS sandbox should be further locked down to limit communication only to whitelisted IPs/domains which must all be under the control of the verified developer. And hey, you know what, let's even require the developer to submit the app in source code form.
> There's no practical way for Apple to prove that any app won't betray the user.
This is honestly a fundamental problem with both the App Review model, and the very concept of cryptocurrency (which for the record, I'm positively inclined towards, both technologically and ideologically):
- The Review model because the developer doesn't actually submit code, and static analysis tools can only go so far. Even if Apple started requiring source (opening many thorny IP liability issues), no reviewer can realistically audit every line. Even then, the mere fact WebViews are trivially common means a developer (or a malicious hacker) can always swap out the web backend with phishing attacks, credit card scams, etc.
- The cryptocurrency model because while it tells a story of "trustless" interaction and autonomy, in practice even the most knowledgable techies end up having to outsource trust to developers, firms, and communities. While it tends to be a safe bet to trust a highly-trafficked community GitHub over a random .ru site, (a) it still requires making a trust decision on imperfect information, and (b) non-technical users suffer an agent-principal dilemma when it comes time to make those decisions, which is a prerequisite to actually use crypto-currency. There are many, many shortcomings to the central-banking state currency model; but at least it has a pretty well-defined UX to the average "holder", and some hope of recourse in the event of a scam.
FWIW, browser-based wallets (with or without client-side storage) do exist, and would probably be used more heavily on iOS if Apple were to forbid native wallets. In which case, it's possible the guy who lost his life savings would have gotten scammed by a "trusted" web app instead.