Both is the best option. Unfortunately there is just about nothing you can do to prevent a government sponsored org from building exploits from scratch to target certain individuals. Apple is doing pretty well at protecting the average person from mass malware like we see on windows and outdated androids.

Chooses both, as far as I can tell.

I can see why you think the need for legal intervention suggests fundamental insecurities in Apple's devices, but wouldn't you agree that it (in theory) is better to take both approaches?

Why do you think it's out of the question to do both? Their legal department aren't software engineers too at the same time.