Recently I found that the macOS accessibility APIs can read individual controls in iOS Simulator apps – you can explore the whole UI from a macOS app.
However, I also found that it appears to shut down entirely once the App Sandbox is enabled. Some forum posts from Our Lord and Savior @justkwin seem to confirm this.
Annoyingly, it's perfectly possible if I use Xcode's private frameworks. I'm guessing shipping a Mac App Store app using those is a no-no, even if I check that Xcode is present? 👀
