What iOS security feature allows apps signed with a developer certificate to run on a physical device, and why can this be abused in attack scenarios?

• A.The developer certificate unlocks the JIT-capable memory mode otherwise reserved for Safari's JavaScript engine; researchers abuse the resulting writable and executable pages to patch Objective-C method dispatch at runtime without re-signing the binary on disk
• B.Developer provisioning profiles allow apps signed with a developer certificate and bound to specific device UDIDs to bypass the App Store review; threat actors abuse this via enterprise/developer certificates to distribute malware outside the App Store
• C.Developer-signed apps skip the TCC prompt layer and each entitlement named in the profile is granted silently; attackers put full-disk access into a profile the target is talked into trusting