The components you are referring to confer a clear and important benefit to devices – a secure boot chain. This is the most foolproof way we know to prevent tampering or hacking a device.
The problem is that some of these secure boot chains don’t allow being overridden by users. Many do – the Pixel series of phones, the M-series of Apple laptops, and Windows S devices all allow “turning off” or “hijacking” their secure boot chains. The further problem if you can turn off secure boot is that these pieces of hardware often can’t then be turned back on with a different secure boot chain – say, one based on open source software. Debian and NixOS and other OSes already have zero-trust ways of verifying the integrity of their software using reproducible builds, but they can’t go the step further and have the hardware it is installed on do the same verification with some sort of signature.
GrapheneOS has figured out how to do this, and it leverages the secure boot chain of the Pixel device. It is very cool and I think a nice symbiosis between the hardware and open source software: https://grapheneos.org/build#generating-release-signing-keys
The next and more problematic part of what these technologies provide is integrity, which is the guarantee that on top of the boot being secure, the software being run is from the manufacturer and it behaves as the manufacturer intends. A lot of functionality currently relies on this guarantee of integrity: anti-cheat software, DRM software (Widevine, HDCP), transit cards, credit cards, driver’s licenses, etc. The technology manufacturers aren’t building this software because they want to, but because they have to. The Original Sin for the iPhone was carriers: at the time in 2008 they were really worried about unlocking and tethering, and the prank of the day was to put a flashlight app into the App Store that allowed tethering via a proxy. Rights holders, carriers, game manufacturers, etc all pressure tech companies to use integrity to solve their problems.
Many of these solutions have alternatives that don’t require OS integrity: if the government issues signed digital IDs, for example, then it wouldn’t matter what software is running on the phone. Some are tough and don’t have alternatives, like anti-cheat and DRM. DRM in particular is a complex US legal issue: anti-circumvention is straight up breaking the law. No solution would be comprehensive without changing the law.
Progress has been made, though! The fact that we have figured out ways of unlocking boot chains in a way that is acceptable to all of the large companies is awesome. Apple does it by being able to guarantee other secure boot chains on the device remain intact, and Google does it by ensuring the device is wiped. This took real engineering effort to do.
It’s important to push these companies to go further. An M1 iPad is almost identical to an M1 MacBook in hardware, and yet Apple only allows the latter to run Linux.
The comment is already a blog post, but another big problem is that these tools are great for anti-competitive purposes… which the government is increasingly taking a look at.