“With that widget extension in place, as soon as I installed the VeryEvilNotify app on my security research device, the ‘Restore in Progress’ UI was shown, then failed with a prompt to restart the system.”
Any App Store app could send iOS system notifications without an entitlement, including the one that starts a device restore. A widget that kept relaunching soft-bricked the phone. Apple took seven months to fix it and paid $17,500. When the researcher published, Apple still had not credited him.