I'm working on a project that will have us create a managed package which can be used for integration between Salesforce and our client's platform (let's just call it Cloud Product). Our client will then make this available to their customers who have both Cloud Product and Salesforce.
The requirements include making it possible to put a Visualforce page in customers' Classic or Lightning page layouts. In the case of Classic layouts, the platform requires the VF page to use the object's Standard Controller. Obviously we cannot package VF pages for the Standard Controllers of unknown objects. We can create a VF component capable of working for an ID of any SObject type, but the customer would still have to create the necessary VF pages.
I tested out the Tooling API and found that I was able to use it to publish VF successfully even in a live production org. So I was thinking we'd have a Setup Visualforce page in which, when the customer's admins set up integrations between Cloud Product and objects in their org, we offer them the option of clicking a button to create the appropriate VF page. This button would call the Tooling API from JavaScript to create a very small VF page, e.g. something like this:
<apex:page standardController="Customer_Object__c">
<cloudProductNamespace:cloudProductPanel id="{!Customer_Object__c.id}" />
</apex:page>
The user who does this would have to have admin-level privileges, but I think this is fine as non-admins shouldn't be seeing this Setup page anyway. It would probably fail in Professional Edition and we can include backup instructions for that scenario. And I believe doing it from JS would remove the need for a Remote Site Setting compared to from Apex.
But are there any other caveats to this approach? Would it potentially cause a problem in Security Review?