There's a lot of nuance here. Some of it is ours, some of it is on Apple's side. Before I get into it I will say that most of what I say about Apple's side is largely not a position they will clarify or take publicly, and some of it is our interpretation. When iSH was removed from the store we did push them to clarify this in the App Store Review Guidelines but they chose to not do so.

When you run an App Store that involves human review the big problem you have is apps that mask their behavior during review and then end up breaking the rules later. My understanding is that the "don't download code" policy is intended to prevent this, at least in spirit. I think, at least at the highest level of the company, the intent is to keep to somewhere near this at least for submissions made in good faith and not prone to opening them up to a slippery slope. There are distinctions here, though, and policy enforcement is also complicated.

My (and iSH's) position is that "code" should be interpreted very broadly, including native code (which the platform blocks from loading anyways) but also things like embedded webviews updated server-side or those "code-push"/"run JavaScript in an interpreter in your app" things. And going even beyond that, I feel that to provide a full experience for the review team when you ship a feature flag you really ought to list all the behaviors that the app can possibly have, and let the review team test that if they want.

From this perspective you will note that code isn't even really the interesting part here, it's the behavior changing that matters. So this leads naturally what we have described as "scripting apps", which download code but do not change their behavior. Their entire point is to download code. Like, App Store is an app store, regardless of whether you download TikTok or Google Maps from it. iSH is a a Linux environment. Nothing you will do in the app will change that. And notably we have zero ability to change that ourselves, short of submitting a new app. It's not like we can just add Windows emulation as a downloadable JavaScript package without going through review. From our discussions with leadership, I think they agree with us on it, but are not willing to commit to it publicly, because then people will take creative bad-faith interpretations of it to argue what a feature of the app versus something a user does in the app is, or something like that. Or they just want to hold all the cards and reserve the right to take this away. Either way I strongly disagree with them doing this, but for now iSH remains on the store.

You will note that the changes we make (see our blog post about repositories: https://ish.app/blog/default-repository-update) continue to support that position. Again, I cannot say for sure whether this is the interpretation Apple uses, or if they even have a consistent position. It's just an attempt on our side to show good faith. As a final note our experience has been that the higher you go the more consistent and reasonable review becomes, but the front-line reviewers often take stupid, unreasonable positions like you'd see in a Hacker News comment (it says code therefore your app for coding is bad). But again, this is just our experience; we have no idea if Phill will hit his head tomorrow and decide to pull iSH tomorrow because he thinks Linux is the child of the devil.