The app submitted for review has to be the complete, self-contained product — it can't fetch and run executable code, scripts, or plugins after install that change its core functionality beyond what was reviewed.
Common with apps that use a remote-config or scripting SDK, often for A/B testing or hotfixes, in a way that changes app behavior beyond simple content or copy updates.
"Your app downloads code in a way that introduces or changes features or functionality without being reviewed, per guideline 2.5.2."