Seems like a pretty clear violation of the rules. Trying to find a loophole doesn't work, the rules aren't an Ethereum smart contract, they're actually subject to human judgement.
I thought the stated reasoning for the rules was that Apple for safety reasons didn't want apps downloading and running code (javascript in this case). Clearly that justification doesn't apply if the code runs on a server and not the device.