If Apple had user's security in mind, it should be the easiest thing in the world to do. - My local password manager / OTP app doesn't need internet and I want to exclude the possibility of exfiltration.

Love the mitigation tech, but politically Apple is only interested as long as it doesn't hurt their cash cow. Ad tech and app devs with spyware.