It's against the App Store rules but if you build an app with React Native/Expo you can OTA update it to do something completely different without going through another review. Enforcement is minimal, especially since you can selectively roll out updates to make it unlikely that a reviewer gets it.

It's such a weird thing to be concerned about though. Your phone automatically updates apps by default so they can suddenly look different later. And even then, so what? If the change was malicious just stop using it? Apps are sandboxed, websites are sandboxed, you'll be fine.

Not really, no.

Not that it doesn’t occasionally happen, but at that point you’re trying to dodge the police… as compared to there being no police in the first place.