On the other hand, if piracy apps can do this (and I'd argue Apple cares more about piracy than actual malware), malware definitely can.

But then again the top-grossing apps are already scams and have been around for as long as I can remember so this is not new.