Fair point. I can think of two ways they could implement this.
First, if the 'paste' command could also be triggered somehow from outside the app itself (e.g. hardware button, or from the Control Centre, or something like that). In that case iOS could capture the event before the app, which means it could be certain that the event was genuine and not fabricated by the app.
Second, if third party apps were never allowed to manage any kind of edit boxes themselves. Every time an app displayed any kind of edit box, the entire interaction of the user with that edit box would have to go directly through iOS, by-passing the app. Every time the user interacted with the screen, iOS would have to decide whether the interaction happened in an app-managed or iOS-managed area of the screen, and to act accordingly. Not impossible, mind you, but complicated to implement, unnecessarily restrictive, and would require massive changes to the iOS core and possibly loss of functionalities in many apps.
So you're right. It's not impossible. But it's impractical and very unlikely to happen. It's certainly not as easy as just adding an extra 'if' clause to the code, as the OP seems to think.