Apple license the CPU cores from ARM, and the GPU cores from Imagination Tech. They stick those parts into a package with a bunch of other (probably all licensed and designed by other companies) parts and send it to Samsung, who make it.
So yes, they do buy off the shelf parts, and get somebody else to make it. They do create the package as a whole though, if the parts are bought in, and they do tweak the CPU quite a bit as far as I know.
Nvidia do the same (which is why tegra and A5 have the same CPU!). They also tweak the design, which is why performance is slightly different between them (the tegra actually dropped a whole section of the CPU called NEON that's quite important for some apps). They do design their own GPU though.