[CRConrad]

> The binary is never changed.

> Apps can behave differently based on a flag set in the cloud, that’s only triggered after approval.

But if this do-nothing app _did_ do something in the review phase, then why switch that functionality off afterwards? If you've already gone to the trouble of writing (or stealing) code to do _something,_ at least enough not to be refused entry into the App Store with a "does nothing at all" verdict, then your scam will only be hurt by switching even that minimal functionality off: Users will just quit using it all the faster. You'd use your remote switch to activate the scamming bits, not to de-activate the rest.

So I don't believe that's how this particular app under discussion got through. It can't have actually done anything useful in the review phase either.