If you bless some app with private permissions that allow it to do what Apple's competing app can do wrt whole-OS tracking, you now need a contract, some level of source code access, and a lot of time dedicated to reviewing what goes into that software to ensure the company isn't beaming it (even accidentally) to a third-party like FB via the FB SDK, and then Apple needs to make the decision "do we allow them to store this in their servers, or do we force them to do it on-device?".

In every situation, it makes more sense to segment and triage private APIs for a promotion to a public API with user-friendly permission prompts and controls to protect the user's data.