The binary may use _malloc function instead of calloc.

Memory allocation is a nuanced topic,
where trade-offs have to be made between performance
and resilience to vulnerabilities.
Merely using malloc is not automatically indicative
of a security vulnerability.
While we welcome concrete reports (see below)
for cases where using calloc would be preferable,
in practice it would be inappropriate to uniformly
replace all malloc calls with calloc.

The iOS binary has a Runpath Search Path (@rpath) set

The binary has Runpath Search Path (@rpath) set.
In certain cases an attacker can abuse this feature to run arbitrary executable for code execution and privilege escalation.
Remove the compiler option -rpath to remove @rpath.