The recent Facebook scandal of running a service to receive requests for tracking shows the app store sandbox model is far more of a denylist vs an allowlist, it's leaky by design in the name of "developer enablement" or "user experience".