When the app is being built, Runpath Search Path refers
to the paths the linker searches to find dynamic libraries
(dylibs) used by the app.
By default, iOS apps have this set to
@executable_path/Frameworks,
which means the linker should search for dylibs
in the Frameworks directory relative to the app
binary inside the app bundle.
The Flutter.framework engine,
like most embedded frameworks or dylibs,
is correctly copied into this directory.
When the app runs, it loads the library binary.

Flutter apps use the default iOS build setting
(LD_RUNPATH_SEARCH_PATHS=@executable_path/Frameworks).

Vulnerabilities involving @rpath don’t apply
in mobile settings, as attackers don’t have
access to the file system and can’t arbitrarily
swap out these frameworks.
Even if an attacker somehow could swap out the
framework with a malicious one,
the app would crash on launch due to codesigning violations.