Technically yes, but such app would not be accepted into the app store as it does not use Apple's IAP protocol and the matching 'Made for iPhone' trademark. Approvals for those things must be thoroughly reviewed by Apple. The reason this way works is because /dev/tty.iap has crwrwrw permissions with the owner of root (and crwrwrw means the userland user, mobile, can access the port).