There is no way for Commodore BASIC to run malicious code in this emulator - it's a sandbox in a sandbox![]()
If Apple's concerns were about security, that would be relevant. But, as is so often the case, when they say "security", what they really mean is "profit security".
If the emulator can run arbitrary BASIC code, it can run arbitrary BASIC code that Apple hasn't gotten their 30% cut on. As Thomas Harte wrote, Apple doesn't want this to be the wedge that opens the door for allowing any kind of program that can be extended post-purchase to do additional things without Apple getting to impose their fee structure on the extension.
Even ignoring the potential for viable iPhone applications to be written for the C64 BASIC, it would set a precedent for other more capable "platforms" to appear on the iPhone. And of course, even C64 BASIC does present a perfectly useful platform for a wide variety of certain kinds of applications.