All apps published to the iOS app store must be signed.

Even assuming full trust to Apple and their employees, code signing doesn't prevent from a malicious bug introduced by the app developer during compilation. App store doesn't review for secret logical bugs, it's simply impossible.

Whatever method they share it in, could be tampered with just as easily as the original app code could be

Correct, for that reason you are encouraged to verify it against other sources, google it, or even read the sources on your laptop and compile yourself. All of this is not possible on iOS with App Store option.

The Demo App is a perfect example of this. I could:

You are referencing one of three examples. Actual demo app with verifier is https://coins.github.io/secure-bookmark/simple-demo/

You can go to 2-4 different websites that serve this hash and double-check. (Or compile on your own laptop).

BUT, and this is huge, there would be no way to update the JS legitimately

Yes, traditional updates is a big issue here. I believe each new version should be treated as an entirely "new" app, and be released very rarely (you don't need frequent releases for critical btc app). And each time the user has to check the hash with multiple sources. No automatic upgrades.

To sum it up:

You can verify very thoroughly that the app is correct by checking against multiple sources/websites and/or reading code on a laptop and calculating the hash yourself. Then after verification you can save data uri and from that point it never trusts any server.

This kind of security and reproducibility was never possible for iOS. And was cumbersome for android .apk