This is total speculation, but here’s one reason the strategy might be smart: You can be held legally responsible for your specific marketing claims, but not fo

This is total speculation, but here’s one reason the strategy might be smart: You can be held legally responsible for your specific marketing claims, but not for your reputation. Since security is difficult, aggressively marketing your products as secure is fraught with liability. Sooner or later, some oversight is likely to bite you, and if you’ve made promises, you’re now on the hook for those promises. But if, instead, you just talk about what technical steps you’ve taken to improve security, and then let enough time pass, you can get a reputation for being secure without ever having made any guarantees. You just let people notice how you respond to security issues, and the relative frequency with which you have breaches. That strategy takes longer to work, but it’s harder to sue you for a public perception which you never actually endorsed. Assuming this is the strategy, I don’t even think it’s particularly nefarious. It’s fairly incentive-aligned, since it only works if your track record is cleaner than your competitors, and it hacks around the fact that consumers aren’t willing to pay the price for actual security guarantees (which would probably involve SLAs, and Apple essentially acting as both a vendor and an insurance broker).