Apple explicitly allows shipping Javascript OTA updates to web based apps. I think they just don’t want apps to sneak in usage of restricted native features between review cycles.