They can do that for apps because apps are compiled and submitted. The expressly do not allow for dynamic code execution within apps to keep functionality from changing after their review.

That cannot be "just replicate"d for javascript extensions.

> That cannot be "just replicate"d for javascript extensions.

This is false too. If extensions aren't allowed to communicate with the internet and can't auto-update themselves, then they also can't run arbitrary code without the user's consent.

> The expressly do not allow for dynamic code execution within apps to keep functionality from changing after their review.

This is false. You can deploy a react native app with dynamic code downloading and execution to the apple app store.

Apple is doing reviews for extensions, and also tightening up the APIs at the same time. At least on the Mac you've got alternatives if you're willing to make a different trade off. iPhone users and ChromeOS users are stuck.