[jsrn]

Regarding your (2.) - just to clarify this for others: With an enterprise provisioning profile, you can deploy your app to an arbitrary number of devices. These devices do not need to be known before via UDID (as with normal OTA provisioning). You can just upload the app to a server and ask people to download. So the devices do not technically have to belong to the same organization (even if this is perhaps Apple's intent). E.g., a friend of mine uses an enterprise account which they aquired for their university to deploy an app for a study (for data gathering). The subjects who install the app and enter their data are not all part of the university. Apple was informed about this use case and they did not have anything against it.

But, AFAIK Apple centrally checks the validity of the profile with each download and thus they are certainly able to detect if you use your enterprise profile to circumvent the appstore.