It's against the App Store rules but if you build an app with React Native/Expo you can OTA update it to do something completely different without going through another review. Enforcement is minimal, especially since you can selectively roll out updates to make it unlikely that a reviewer gets it.

It's such a weird thing to be concerned about though. Your phone automatically updates apps by default so they can suddenly look different later. And even then, so what? If the change was malicious just stop using it? Apps are sandboxed, websites are sandboxed, you'll be fine.