I don't think all bases can be covered, certainly. But neither do I think Apple has been doing a good job of even trying to do a good job of it, at least recen

I don't think all bases can be covered, certainly. But neither do I think Apple has been doing a good job of even trying to do a good job of it, at least recently. Apple clearly put some thought into how the product would be misused, and added some features for that - but then appears to have not bothered having actual (simulated malicious) users test those features to see how they'd bypass them. Things like "removing the speaker" seem oddly trivial, yet there's no indication Apple even thought through that situation. It wouldn't be too difficult to design something in which the deliberate disabling of the speaker rendered the device useless after a few days, yet would be unlikely to trip in normal use. They're pretty well sealed. "Red teaming" something like this in the early design phases is often useful to be able to figure out how to mitigate these sorts of attacks, and Apple, far too often lately, seems to be in a "...they did what? No, they can't have... we didn't think they'd... ugh, OK, let's add something to support that..." mode. And if they don't have family sharing support, as seems to be the case from the other comments here, it clearly means they weren't tested with any sort of realistic use case, because "Oh, yeah, my wife's keys in her purse keep making my phone go off when we're driving together" seems a common use case to discover in testing. I don't think a company should be responsible for all malicious uses, but when those uses seem utterly trivial to manage (remove speaker, your tracking target uses Android and like almost all Android users hasn't downloaded Apple's app to check for AirTags following them), I think they've missed something really important in the design phase.