1) "Are there any other internals which I've missed and worth noting."
I'm not sure if I've understood you correctly, especially at the "worth nothing" part but there is a big change on the sandboxing mechanism. According to a review at The Register, Microsoft removes a part of the sandboxing for the applications which have been downloaded from the Application Store (not sure if this applies to the 3rd party applications).
Also, they have been thinking of expanding the Windows API so that more features and libraries will be usable by the user applications. To defend this choice, they claim that it should be users responsibility to inspect the applications intent rather than blocking the applications capabilities.
Finally, Microsoft is still considering if it was a good idea to unify the platforms or not, according to the link above. If you ask me, these are some radical changes. I'm not an expert on the UWP topic but as far as I've seen, it is only a way of packaging rather than an effort to implement heightened security. A .appx file seems to contain; a standard executable, block map file which contains file hashes, an app signature and the rest of the data such as images and so on. Maybe they will take more and more radical decisions soon, such as reverting back to the old structure.
2) "How would we approach pen-testing UWP apps targeted at Windows 10 tabs and devices."
Debugger: Well, as with any other Windows application I would start with OllyDbg or an equivalent debugger to analyze the behavior. If you know how to read a debugger output, you can gain a lot of information quickly.
Fuzz Testing: Again same with the debugging, always a good choice to try. Forcing various data towards the application through input channels may reveal some information about the application.
Now, for the attack types:
DLL Injection: It seems to be working with the UWP applications too but only if the included DLLs in the .appx are not signed. Trying to hook different malicious DLLs might give you an insight on the security side. In here, actually somebody used this method as a game mod.
Privilege Escalation: Although there is a sandbox mechanism, it is not a guarantee for perfect encapsulation. In fact, the post in this link claims that somebody have managed to use an exploit in a 0-day payload to escape APPCONTAINER mechanism.
Input/Output Sniffing: Lets assume that your application is secure as a castle itself. All DLLs are signed, there are no exploits in the DLLs you use or in DLLs which belong the system. Fuzzing tests have found not even a slightest bug. Even in this situation, there might be design flaws in your application which you will have to consider. Does your application show a valuable information in clear text which can be obtained by a screenshot? Does your application communicate with an external source without an encryption? These questions actually do not depend on the UWP system but again they may reveal delicate information about the application or the user. Your application can be secure but Windows still uses Win32 applications beside the UWP ones so you have to be careful about the design flaws.
That is what I can think of now. I've never used any of these methods on a Windows 10 before since it would be more beneficial for a hacker to utilize phishing methods rather than look for cracks in the software. Hope it helps!