> how much cryptography and security would Apple need to open up to have 3rd party BLE devices ping to other services outside of their control that may leak the location information of people walking past them.
None, simply proxy it through Apple's existing servers and do not include any information about the device that found the tracker. If you are worried about rogue devices telling iPhone to ping rogue services, then just add a service whitelist to the scheme: Apple trusts Google's service and Tile's service, Google trusts Apple's service and Tile's service, but <random URL> isn't going to get pinged.
Now just make a process by which you prove legitimacy in order to get added to the list and require platform approval.
> Why should {arbitrary phone creator} need to ping a 3rd party whenever someone comes within range of the BLE device?
Because if every phone could ping the network associated with every tracker, then the strength of the network is all participating devices, not just OEM's brand. Apple gets the benefit of having a better Find My network outside the US where Android dominates, and Android gets the benefit of a better Find My network inside the US where iPhone dominates.
> That is, if Android devices aren't required to ping Apple's Find My network when in range of an AirTag, why should Apple be required to ping Tile's servers when in range of a Tile?
Required is a strong word, but Android should ping Apple's network when it sees an airtag, and I bet Google would take that deal if it were available.
All this is sidelong to the point though, that Tile cannot build an app that iPhone users can use that can tie into the beacon functionality the iPhone is already doing in order to enable Tile users with iPhones (that is, those iPhone users with the Tile app installed) have as reliable and friction-free an experience as iPhone users have with airtags.