There are several major considerations that implementers of smart-app-state need to consider that go beyond what is needed for other parts of the SMART spec.  For example:

• smart-app-state imposes significant new liability on the implementing EHR and hosting healthcare organizations (for an extreme example, an app stores CSAM material).  
• In the case of a data breach in the EHR, disclosure notification for smart-app-state is difficult.  For example, if keys are leaked, the EHR does not know what those keys grant access to.  Does the key grant access only to the patient's health data, or their entire iCloud account?
• Managing data access policies for the smart-app-state data is difficult/impossible for the EHR to do (since EHRs won't understand the data to apply EHR-specific access policies, and the app doesn't know who the viewing users are, so they can't apply app-specific access policies).  There is no clearly responsible party for determining who is responsible for managing which users can see app state content.
• Managing client identity access rules is a major new responsibility (which clients have access to state submitted by other clients).  Note that even in the Apple use case, there are two client identities, the patient submitting app and the provider viewing app.
• It is unclear how smart-app-state data should be handled with respect to EHI and Info Blocking (and maybe GDPR?).  Similar to the access policy issue, how would an EHR or healthcare organization know if smart-app-state content should be included or not due to privacy or other exceptions.  Or what fee structures are allowed.

For the reasons above, and especially because there is significant risk of regulatory agencies (in the US, but also in the EU) naming the SMART App Launch IG as a a required technology without carving out smart-app-launch or experimental features, we'd strongly prefer to see the smart-app-state split into a separate IG so that implementing EHRs are not forced to bear the liability, disclosure reporting and other responsibilities that are imposed by this feature.