Technical Analysis – Improper Use of Private iOS APIs in Vietnamese Banking Apps

I'm curious about this. I'm familiar with reversing http api calls using a mitm proxy. But this ain't that.

Are they able to load a .so/dylib file during runtime and just call a method on it as long as they know the name of the method? How does iOS even allow that? How does an iOS even get to load those files? Seems like that would be locked down.