Indeed. And Apple my have been trying prevent apps from being overly vulnerable from the start: the approval process will reject:
2.7 "Apps that download code in any way or form will be rejected"
2.8 "Apps that install or launch other executable code will be rejected"
Those clauses are to prevent the application from downloading code that is not reviewed. Blocking HTTP requests and requiring HTTPS requests would block several categories of legit applications but it would be nice to have them explained.