I believe this is actually only true under very specific circumstances -- namely, enterprise certificates, which are used to distribute apps directly to employee devices, without going through the app store. If they decide to revoke a regular developer certificate, the apps already distributed through it are not affected in any way.
They can control which apps can and cannot run as long as those apps are intended for internal use by enterprises. That seems reasonable imo, given that these apps are also not subject to any approval process.
No, they can control what applications are allowed on their app store and control how the OS they distribute runs. Aside from those two things they can't really force anything that you haven't already allowed, or continue to operate.
Apple can't physically confiscate the phone or the data that you put onto it's hard drive (not talking about iCloud). It's yours. You can put linux on your iPhone if you want and there is nothing Apple can do about it.
