I think iOS and Android already holds the threat of app store removal over developers' heads.

Presumably the risk/reward still favors risky practices.

but it's not contingent on backend violations, only frontend ones. I'm proposing decoupled ways for app store validation to audit backend security.