It depends on whether the access is to be to encrypted data at rest or something like a realtime wiretap, and if there needs to be a way to prevent the spied-on party knowing they were being spied on or not.

One way to do data-at-rest (e.g. a locked phone) is to require physical access to the phone along with some kind of expensive, destructive procedure (e.g. an electron tunneling microscope and shaving away the housing of the secure enclave area).

Also, I'd assume that any competent target would just layer their own encryption on top of the existing stuff, so the whole system would only be good for catching unsophisticated criminals (and spying on the general public).

Or I'd just subpoena the iCloud backups and have Apple decrypt them, which they can already do.