Showing a 5000$ bounty example of "enumerating all apps" sounds a bit disingenuous when this is more of a "check if this exact app by bundle name was installed not through store.
I also don't think that this deserves to be called anything as scary as an "zero day exploit", "sandbox escape".
I also don't think that this deserves to be called anything as scary as an "zero day exploit", "sandbox escape".