The console threat model is far too different to the mobile device threat model for any direct comparison. Console users will deliberately withhold security up

The console threat model is far too different to the mobile device threat model for any direct comparison. Console users will deliberately withhold security updates, so that they can later hack their devices. Console security updates protect the vendor from their users. Mobile users (who care) will always be on the latest updates. Fresh browser exploits are exponentially more expensive, generally speaking. Allowing users to use different browser engines doesn't necessarily widen the remote attack surface, it just changes it. But yes, ultimately I think Apple cares more about losing their walled garden, than they do about security.