It's not the ISPs themselves, necessarily. You have a box that you own and that sits in someone else's network, where their security policies and practices apply. Those policies and practices are not going to be the same as yours. Perhaps more importantly, other people have physical access to the hardware. That includes employees of the ISP, but perhaps also 3rd parties (think multi-tenant datacenter, for example). That's why you should treat that box as being in a hostile environment.

Imagine you're a state-level intelligence agency, you often can force ISP located/headquartered in your country to obey, and it's probably easier to infiltrate some small-ish out-of-country ISP than an Apple/Google/Amazon data center.

It's not necessarily that the ISPs will want to break into equipment, just that they are the weakest link bad actors can use to target Apple/Apple Customers.

Apple has a history of paranoia and unwillingness to trust their own employees, let alone their business partners.

Also, there's a surprising number of colo facilities that are pretty lax about who is allowed to come and go.

> why do you think ISPs would break into Apple's equipment just to extract private keys securing media files and software downloads

Being able to sign some things as Apple / MITM some Apple URLs strikes me as interesting enough to get state-security level interest, at which point you fall back to ISPs being made of people, and people being coercible and bribeable.