They could have, but that's why Apple has an app review process. It's been criticised (by me, for one) for being heavy handed and slow, but recent events have shown that there's a wisdom to it.
No one really knows. But I wouldn't be surprised if there's a mix - I'm sure there's some automated investigation of how much data is sent, when and what that data is.