My assumption is that the server either directly tells the client what to display or it converts the “client” code to some kind of bytecode that doesn’t require a lua interpreter.
Or perhaps the lua code is sanitised by the server such that the lua code run on the client is not the same as submitted by the user. Many App Store games do have an embedded scripting system of some kind, just not one that can run code directly inputted by an end user.
Bytecode or not it is still running code inputted by an end user on iOS devices.
The whole point of Apple's rules here are to force app functionality and features to be reviewed when submitting an app to the app store. Anybody can go and make complete games ("experiences") in Roblox and they will immediately be available on iOS without being reviewed by Apple. It's a full game engine that lets you write custom code, use custom assets, and replace everything. Take a look at Frontlines (https://www.roblox.com/games/5938036553/FRONTLINES) as an example of a game that looks nothing like Roblox.
If you were to release an iOS app and push new features and content to it OTA then you risk being kicked off the store if you get caught because you bypassed their review process and the store page may not be accurately describing the app anymore.
Or perhaps the lua code is sanitised by the server such that the lua code run on the client is not the same as submitted by the user. Many App Store games do have an embedded scripting system of some kind, just not one that can run code directly inputted by an end user.