It's interesting that by owning and using that Class A block, Apple are making it easier to scan for their infrastructure. Moving that to IPv6 and releasing the Class A would help them avoid the preliminary scanning that was performed.

There's also something to be said about migrating internal DNS to a subdomain of apple.com that is only visible internally.

Not solutions to security, but making things harder to scan makes it harder to find the vulnerabilities.