My Samsung A40 has a toggle called "OEM unlocking - Allow the bootloader to be unlocked". That's in the developer options. My previous phone from Sony had the same option. If Apple wanted they could do the same.

Security loopholes are a different thing.