Also about validating the backends, apple has the resources to provide a level of auditing over the common backends. S3, Firebase -- perhaps the top 5. It's easy to provide apple with limited access to query backend metadata and confirm common misconfigurations.

I partially agree. At least the threat of app shutdown would be enough consequence for the publisher to take things seriously

I think iOS and Android already holds the threat of app store removal over developers' heads.

Presumably the risk/reward still favors risky practices.

but it's not contingent on backend violations, only frontend ones. I'm proposing decoupled ways for app store validation to audit backend security.