The typical driver is that the standard is a poor fit for purpose because it was originally designed by companies operating under a more limited set of constraints and use cases. In some of the cases I've been involved in, the deviations required to make it fit for purpose would immediately save millions of dollars per year versus following the strict letter of the standard, so the value of deviating was not academic. The reason you keep any deviation close to the standard instead of designing a new one is to minimize the interoperability gap in practice.

If you are able to articulate why the standard is not fit for purpose to the standards organizations, they may use it as a driver for a new standard. However, this frequently runs into strong political resistance from the existing member base because they rarely benefit from the increased scope -- all downside, no upside. Nonetheless, the standards organizations are invested in maintaining relevance. As a practical matter, unless you go into these discussions with the standards orgs with an existing implementation of an alternative that threatens their existing standard, they are very reluctant to move.

I'm not saying any of this applies to Apple's case but the above happens a lot in my experience. It would be nice if it was easy to work with the standards organizations if you need to make a standard work for other use cases but in practice it is an extremely difficult and political uphill battle.

I think that for people outside of HN, that's OK. Not everyone trusts the open source community, or open source organizations.

If something goes wrong with something important, it's normal for people to want something or someone to blame. If that something is Apple, that's useful. If it's some rando on the internet contributing code to a code repository, it's significantly less useful to the ordinary person.

For the average person, entrusting Apple with their logins is a better option than using password1234 or some other coping mechanism. People know Apple. Nobody knows OpenID. It's the same reason people used to trust Microsoft (and many still do!) with their personal information. Microsoft is a known quantity.

It's like having a neighbor watch your pets while you're on vacation, or signing up with some random service on the internet to watch your pets. Those random services get bonded and insured for the peace of mind of the user. There is no such level of assurance from OpenID other than it uses the word "open" in its name, and as a culture we value the word "open" more than "closed."