That's the same way a CA works (except with a bit of automation instead of emailing someone).

I go to the CA that issued my cert and say "I'd like to revoke this" (whether that is an API call or an email), they then publish the cert into their certificate revocation list.

Now, Apple could deny a request, but they are under no obligation to do so, and I would argue that they shouldn't be making those judgement calls.

As they did here, they get the email, they then publish the CRL, and wash their hands off it.