This is why no amount of "but apple cares about privacy" will ever make me drop the "Trust but verify" I try to live by (money allowing), even if I believe they care more than most.
I look at the “Apple cares about privacy” as a qualified “more than them other OS &mobile firms”, not “enough that you should blindly trust us”. No one’s security is perfect
Including your own! A big part of opsec is putting systems in place that mitigate dangerous but unavoidable human behaviour.
Apples security model seems to mostly be based on fixing issues fast and pushing them out to almost all users. That means the only people at risk are those worth burning a brand new exploit on. The average consumer is pretty safe.
When it come to security (and literally everything else), don't even both with with the "trust" part and skip directly to "verify".