Surely this check could be done on install/first run, then cached?

If you want rapid blacklisting, a frequent call to Apple to say "anything new blacklisted?" would suffice. Same as push notification.