Apparently Apple is ok with out-of-band updates as long as they don't add or change features. If it's used to fix a bug then it's ok (at least they haven't cracked down on React-native apps using codepush/expo's auto update feature, yet.). There have been reports of Apple's reviewers asking for clarification on why apps have the ability to update, and as long as the answer is "bug fixes" then they approve the app.