> I suppose you could find a vulnerability in the app itself, but iPhone apps are themselves sandboxed to prevent installing code without getting an elevation prompt (which is what that "Login with your iTunes account" prompt really is.)

There used to be a site that you browse to in mobile Safari, and it would jailbreak the phone. A potential vulnerability in the app itself is probably what he meant.