I do not know for sure, that is a question for Apple, but I've read that many app developers just can't get away from using plain HTTP connections and so they might need to justify those exceptions when they submit their app for review. Based on that justification, Apple would decide.
Esri & ArcGIS Online servers already support the latest HTTPS technologies so you don't need to add any exceptions to connect to those domains, but you need to decide independently for other domains that your app connects to.