If Apple can redirect the email to you, they can also store and read these emails.

By that logic so can google with gmail: of course they can, but that’s why we have to put some level of basic trust in our email providers. If you don’t want an MITM, you’re basically stuck with PGP or hosting your own email service.

Lavabit used to not be able to do that, and Protonmail can't either still... (To be fair, Lavabit _could have_ made changes so they could do that, but the owner refused when law enforcement asked him to do that fpr Snowden's email, and risked very real threats of jail instead. I don't think Protonmail have been tested lie that yet, but they have at least incorporated outside of US jurisdiction,which changes their risk in some important ways...)

https://en.wikipedia.org/wiki/Lavabit

If you use Apple SSO but your email is hosted elsewhere, Apple has introduced themselves as a MITM for your email. Facebook SSO doesn't do that.

you can use apple sso with the real e-mail too, as far as I remember. it’s an option.

Oh sure, it's just that it adds another "man in the middle", where previously there was only your own email provider.