Between lack of a a nonce and an asserted exposure to code injection and replay attacks, the issues in the letter imply a week of vulnerability research could yield a complete takedown of the product - which would suck because an Apple sign-in experience using their TEE is really valuable.

I could see someone making the choice where they would elect not to manage a nonce because its permuting effect was achieved by other parts of the protocol. Apple also has keys in a TEE, and a nonce generated and synchronized outside of that could have been interpreted as creating additional attack surface.

If the OpenID letter is correct, there are exploitable vulnerabilities in Apples implementation that could be demonstrated. If they are not correct, they could just be angry Apple is leveraging its TEE to assert it doesn't need governance from this standards body because the standard is written for products without a separate hardware keystore.