The "code is speech" argument is more subtle than people appreciate here. "Speech" is not a type of thing. "Speech" is something someone does. A black armband can be speech when it's being used to express an idea, or it could just be an article of clothing.

In my opinion, code in its functional capacity is not speech. The code that locks the user out after 10 tries is just the digital equivalent of a gear or valve: a functional building block of a machine. A gear in its functional capacity is not speech, but can be if used in a piece of sculpture for example.

In this particular context Apple has a stronger argument, though. The act of signing code does express an idea: Apple's trust in the code. That might well be protected speech.