Just looking at the readme sample code it appears to be using APIs unavailable in iOS, so where is the vulnerability?
As far as I know, how the review happens is that reviewers just install apps onto their iPads, tap through all the screens they can find and make their decisions based purely on that. So if an app connects to server and asks what it should do, it's possible to make an app behave differently for reviewers and all other users.