You can also get away with a much weaker passphrase if you can somehow rate-limit brute force attacks. As I understand it that's one of the things the T2 does, you can't authenticate except through the T2, and the T2 will slow you down and lock you out after n tries.

And I think that's actually incredibly underappreciated feature, most people are both bad at memorizing long, complex passwords/passphrases and not all that motivated since the threat is quite abstract. I've had a hard time convincing some people to have any sort of password at all on their laptop (that they travel with, work in all sorts of places and are overall pretty careless with), as it carries the risk of forgetting the password and it's cumbersome and inconvenient compared to being able to simply open the computer to a logged-in desktop.

Making security less of a hassle really does help with adoption. Having a short, relatively weak, but not trivial password is way way better than having none at all, and realistically that's all most people are ever going to have, so making those passwords hold up better is a really smart move that instantly ups the security of lots and lots of people out there.

But that's not something I believe you could do without a scheme like tieing the encrypted data to a complex secret inside a specific T2 that is uncracked, otherwise you could simply put the SSD in another computer and brute-force it there.

The initial transition from the apple root of trust to your own root (which you would then use to install new hardware) could require being authenticated, this way a thief couldn't do it while the legitimate owner could.

That's a route I hadn't thought of.

Seems like a great idea!

Trying to prevent theft that way is a fundamentally flawed approach. It's in the end all about controlling the phone you brought to prevent you from using it in any way they don't like or using it longer then they like (by repairing it).

Theft will happen anyway. You can even sell permanently-locked/bricked devices to people which doesn't look to closely at the sellers description. Sure you will need to sell them for cheap, but that's all.

That idea is like saying all cars must be always tracked, always link up with the drivers phone and be remote-controllable by there manufacturer to prevent theft.

Sure it would prevent theft, maybe, until people find ways to brake it. But it's still totally unreasonable with a lot of hidden cost to it.

E.g. in case of apple laptops the cost is losing a lot of small independent companies as well as any way to properly repair an Apple laptop. (Apple doe NOT provide proper repairs they at best replace whole components often the whole main board because it's one component when many damages tend to be similar because people use their devices similar and often are reasonable fixable with a bit of not-easy-but-not-very-hard-either soldering).

EDIT: And most important! The theft constraint can be archived to a reasonable degree WITHOUT locking out third party repair. A example (through not applicable to mac in this case) is how I setup my laptop with a custom EFI platform key/certificate and a BIOS password so to reuse it after theft people have to replace the BIOS chip soldered onto the motherboard (it has no publicly known master key or reset pin). Apple can archive similar things so that theft is more costy but third party repairs are still mostly unconstrained.

In general I agree with your points. But reducing the profit achievable on stolen devices can reduce the motivation to steal them. Whereas there are already big risks involved in stealing a car so adding DRM wouldn't be that much of an impediment in that case. (And cars already do use DRM in various ways.)