By that logic the bad actor will just explain that he needs you to log into your online bank account so could you please do that and wire some money. Such scams certainly exist but it isn't a relevant attack vector for the sort of end user security that we're talking about here.

You can load your own root CA on iOS devices (i did it to enable certificates issued by my own private CA). That bypasses a LOT of security issues, and yet it’s still feasible.

Put it in the bootloader then.

The pretence that Apple makes these things for security reasons and there's absolutely no way in the world to make it possible is a bit ridiculous.

But we have another example to look at. Why isn't this a big problem on Apple laptops?