Apple allows limited code execution. You can build cordova application and download new JavaScript code as an update. That's fine from Apple's PoV. They don't allow arbitrary machine code execution, like someone getting into AppStore and then downloading and executing malicious code calling private API. But if your code is run with JavaScript engine, it's fine.

Now I don't know about possibility of implementing browser plugins. I guess that it should be possible, but API would be different from other platforms.