Many developers do this, and it's explicitly allowed under Apple's Developer Agreement (section 3.3.1).

  Interpreted code may be downloaded to an Application but only so long as such code: (a) does not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application (b) does not bypass signing, sandbox, or other security features of the OS; and (c) for Applications distributed on the App Store, does not create a store or storefront for other Applications.

Weird, because Apple took down Fortnite for enabling a direct buy-button (bypassing IAP) after review completed. Just because an offending feature wasn't enabled at the time of review absolutely does not mean you're in the clear to turn it on after the review is complete. Whereas before you'd get the opportunity to fix anything like that during the review process, by sidestepping the review process you'd better be confident you don't ever ship anything that wouldn't pass.