App Store Guideline 5.6 rejection (fraud pattern / "hidden features") on a Median-wrapped app, also stuck on Beta App Review. Anyone else hit this?

Setup: live sports scoreboard website wrapped as a native iOS app via Median.co. Native features (push via OneSignal, share, calendar links) wired through the JS bridge.

Issue 1: Full App Store rejection:
Submitted for review, rejected same day under Guideline 5.6 (Developer Code of Conduct):

"We've identified a pattern of unusual behavior with the app that is commonly associated with fraudulent activity. Specifically, the app contains features that appear to have been intentionally hidden during the review process."

No specifics, no attachments, just that.

Issue 2: Beta App Review (external TestFlight) also never resolved.
Submitted for external testing days earlier, and it's been sitting in "waiting for review" this whole time with no approval, no rejection, nothing. Now I'm wondering if both issues are connected — same app, same underlying architecture, potentially the same automated detection flagging it at two different review checkpoints.

What I've confirmed is NOT the problem: no gambling/wagering code, no geolocation or IP-based branching, no reviewer-detection logic of any kind, full codebase audit came back clean on all of that.

What I have found and already fixed, in case it's relevant to anyone else:

One FAQ entry was platform-conditional (hidden in-app, visible on web). Removed, now identical everywhere
A handful of admin-only routes (internal ops dashboard) exist behind a role check, a reviewer without admin access would just see a generic "access denied" now relabeled to clearly say "internal staff tool" rather than a blank denial

Questions:

Has anyone hit a 5.6 fraud-pattern flag specifically tied to Median (or similar webview wrapper) apps? Any known triggers in how Median's bridge/wrapper code behaves that Apple's automated scanning might flag?
Could a stalled Beta App Review and a 5.6 full-review rejection plausibly share the same root cause, or are these genuinely unrelated processes?
Anyone gotten a 5.6 flag cleared, and if so, did it resolve through Resolution Center replies or need the formal App Review Board appeal?

Appreciate any insight. Happy to share more detail if it helps someone else avoid this.