https://developer.apple.com/app-store/review/guidelines/

  > 2.5.2 Apps should be self-contained in their bundles, 
  > and may not read or write data outside the designated 
  > container area, nor may they download, install, or 
  > execute code which introduces or changes features or 
  > functionality of the app, including other apps. 

The wiggle room is in the "introduces or changes features or functionality of the app" line, they've given themselves vague discretion to reject things that download too much code, but there are tons of apps that do OTA updates that haven't been rejected because they aren't changing fundamental features/functionality.

For a long time, downloaded code could only run inside Apple’s WebKit or JavaScriptCore, but since June 2017, you can use any language and interpreter. Apparently, almost nobody noticed: https://www.theregister.co.uk/2017/06/07/apple_relaxes_devel...

It's good that they revised that ridiculous restriction, but I think they should go further still. It was disingenuous to advertise the iPad as a "computer replacement" when having an environment for Python coding (widely used for beginner programming) was essentially banned. There really should be a way to work in even compiled languages on iDevices.