Back doors are typically not disclosed to the user, and can't be turned off. So for example an automatic software update mechanism isn't a back door, as the user is aware of it and can typically turn it off if they are concerned about security.
An undisclosed mechanism that allows Apple apps to circumvent firewalls does very much fit the description of a back door.
Intent doesn't matter with regards to back doors. Most back doors are not made with malicious intent, or at least the vendors usually claim that they only had good intentions for the back door. (Eg. see the recent reports where a router manufacturer had a secret password that they claimed was only used for software updates)
The danger about back doors is that malicious software can use the back doors to circumvent the security measures, just like Patrick Wardle demonstrated that it was possible to use Apple's content filter exclusion to circumvent firewalls.
Without spending a lot of time sshd has allowLists (AllowGroups) and match directives
Sudo also has per group config
As a user on any operating system what you can and can’t do is controlled by a list
Perhaps the issue is the list isn’t user controlled ?
Perhaps the issue falls into the “I own and control my device” vs “we sell you a safe, foot gun safe, easy to use device (in their opinion)”