I mean, if I wanted to abuse that Advertising ID for nefarious purposes I would just do it in an app that also runs ads. Seems like security theater.
Surely they need to be able to see the ads in the app to make sure they comply with the various guidelines Apple has. Otherwise all they could do is 'take your word for it', and there have been plenty of apps in the store that provide how trustworthy that is.
It would be really easy to just show the reviewers a completely different app from what users see. All you have to do is detect the review process and alter your behavior. This could be something as simple as pinging a server which returns "yes" or "no", and you flip the switch on the server after you pass review.
But nobody does this, because the implied consequences for doing it are not nice.
Clearly you can change the ads being served after it is reviewed, but all they can do is check the ads during the review process.
One of the things they also check for is that the ads aren't too obtrusive.
It's just yet another cat and mouse game.
Let's recap: Advertiser sells ads, doesn't run ads on App Store submitted version, complains that they had to run ads so Apple could verify what the ads are,...?
I'd rather Apple put this app through its places 100x through rather than let a nefarious ad machine through.
Developers are allowed access to something called an "advertising identifier" which lets them track users between apps, for the purposes of targeted advertising. Apple is very restrictive in terms of user identification, in order to protect users' privacy, so this is the only way to uniquely identify a user/device, and the user can optionally opt-out of the advertising identifier entirely.
Apple doesn't want developers to use the advertising identifier for things other than advertising. But the way they enforce this is simply by requiring that an app include ads in order to use the advertising identifier. If you use the advertising identifier and your app doesn't visibly include ads, it will be rejected.
This restriction is ostensibly intended to prevent developers from abusing the advertising identifier, but really it just encourages developers to include shitty ads in their apps, because if you include ads, you can use the advertising identifier for whatever you want behind the scenes. It's a nonsensical way of enforcing this policy. Thus, "security theater."