>whether this is something that should be reported to Apple, if Apple will do anything

Lmao Apple will not do anything for actual malware when reported with receipts, besides sending you a form letter assuring you "experts will look into it, now fuck off" then never contact you again. Ask me how I know. To their credit, I suspected they ran it through useless rudimentary automated checks which passed and they were back in business like a day later.

If your expectation is they will do something about shitty coding practices half the App Store would be banned.