Note that you were always able to easily inject/specify which DYLIBS were loaded into the invocation of an executable. However, the OP describes a way of doing this that is difficult (impossible in a general sense?) to detect.

Second, this would probably be the most effective attack against the sandbox of the Mac Store. It effectively allows injection of arbitrary code into an arbitrary child process.

Third, to my understanding, this does not allow user-bound privilege escalation (e.g. no root) because those are bound by the process, inside of which the code is loaded and run.

Honestly, though, shouldn't be too difficult to patch.