Capacitor iOS apps run on capacitor://localhost, and allowlisting localhost as a domain in Turnstile will work for Android apps (https://localhost) but not iOS apps (capacitor://localhost).
I’ll have to switch to reCAPTCHA or something on my iOS app if this can’t be accommodated for.