“Running machine code” is not a security vulnerability. If your browser isn’t secure all sorts of exploits can happen from a web browser. That’s how a lot of the early iOS jailbreaks worked.
I used to write machine code, but I don’t, anymore. I am quite aware of how powerful it is, so I have to assume that the very smart people at Apple -who deal with current-day machine code- have a handle on dealing with it.
You didn’t state one example where it bypassed the sandbox. All apps on iOS are compiled to assembly. If writing in assembly magically bypasses a well designed OS’s security model, we are in trouble
That’s where a “social engineering” approach can be helpful. The permission request can be quite bland, to a non-technical person.
And yes, a native app with the program counter can definitely do stuff a Web site can’t. Run machine code, for instance.
We would hope the app sandbox is good enough to catch it.