Yes, you are correct. All ios apps must be code signed by Apple which is pretty stringent in it's reviews. This is why you won’t find any apps in the app store attempting to spawn /bin/bash or mimic its functionality.

I believe apple is now requiring all osx apps on the app store be code signed as well.