Yes, I think you're right and I think the FTC would also disagree with Comey on that one. Companies have a duty of care to take reasonable and appropriate measures to maintain the privacy of customer data in their care, commensurate with the scale and sensitivity of the data, and the cost and availability of the tools and technology to protect it.

By that definition it's precisely the Apples and Googles of the world who have the greatest responsibility to design their products to be secure.

In what strange world would we expect the FBI to design TouchID or TrueCrypt or ChaCha20? If anything history has shown us we can't trust NIST or IETF to get it right, or even not to be secretly subverted to get it wrong!