Malicious apps can already do that. There is nothing (technically) that stops you from e.g. receiving a JSON file and enabling secret features.
The ban on third party browsers and JIT is so that you cannot make fully-featured or competitive apps that don't go through the store. Microsoft tried something similar in Windows 8 (certain DirectX features only available for Metro apps, strict guidelines what a Metro browser can do, ...). This is the reason Safari on iOS is lacking certain features wrt. PWAs, and the reason Flash was banned outright (instead of saying e.g. it has to be made more reliable).
If web apps were as powerful on iOS as they are on Chrome or ChromeOS, then many iOS apps including games would be written as web apps, and Apple would not get their 30% share. If someone would port a JVM or .NET CLR to iOS, then you could sideload those apps and circumvent the app store, too.
The ban on third party browsers and JIT is so that you cannot make fully-featured or competitive apps that don't go through the store. Microsoft tried something similar in Windows 8 (certain DirectX features only available for Metro apps, strict guidelines what a Metro browser can do, ...). This is the reason Safari on iOS is lacking certain features wrt. PWAs, and the reason Flash was banned outright (instead of saying e.g. it has to be made more reliable).
If web apps were as powerful on iOS as they are on Chrome or ChromeOS, then many iOS apps including games would be written as web apps, and Apple would not get their 30% share. If someone would port a JVM or .NET CLR to iOS, then you could sideload those apps and circumvent the app store, too.