Apple has pulled it.
Re: how it got through, as others mentioned, it takes quite a bit of work to deep dive into a program analysis. And could be something along the lines of Diesel-gate or Benchmark-gate where the software can detect running in a test mode, in a sandbox, and thus hides their true intent. Also one of the recent year virii that did not activate when it sensed it was not running on a user's machine.
Re: how it got through, as others mentioned, it takes quite a bit of work to deep dive into a program analysis. And could be something along the lines of Diesel-gate or Benchmark-gate where the software can detect running in a test mode, in a sandbox, and thus hides their true intent. Also one of the recent year virii that did not activate when it sensed it was not running on a user's machine.