This is why the Sandbox allows apps to run on iOS whether or not they’re “detected” as malicious, but restricts and contains ALL apps from doing anything that could harm the user
It's mathematically impossible to stop malware.
Due to Rice's Theorem, it's impossible to write a program that can perfectly determine if any given program is malicious.
This is because "being malicious" is a behavioral property of the program.