You can do it, it’s how libsystem does it. A lot of AppStore apps use it for jailbreak testing too, e.g. testing sandbox integrity, or to call ptrace with PT_DENY_ATTACH. Apple lets these apps pass review and onto the AppStore.

Do you know how often, if ever, Apple ever changes the syscall table other than to add to it?

libSystem is provided by Apple. The fact that libSystem does it does not mean you can do it without libSystem, as libSystem is the one and only supported way to do this.

> Do you know how often, if ever, Apple ever changes the syscall table other than to add to it?

I don't know, but I'm pretty sure the answer is something other than "never".