How do we know that the tool doesn't alter the data?

Or perhaps even more likely - process fake data injected by a malicious 3rd party trying to spoof an app.

It's a defence often used in CP cases - 'my computer was hacked! I had no idea the computer had CSAM!' - and it always fails. Because hacking is atypical, courts place the burden on the defendant to prove hacking, and there's usually no good way to do that. Same thing here, except the defendant is in an even worse position.

In theory, a CP felon would have reason to generically hack some another computer (since CSAM storage itself is illegal), and desktop OSs are less secure. In the phone case, you likely need to assume a specific criminal conspiracy entirely meant to convict the defendant, one that must involve the police*, and that's an extremely high bar to meet.

* The police are the ones using the tool; the only way to effectively plant non-generic evidence is to have the corroborating data first and that requires police assistance.

How good is it? Can it extract secure enclave keys or only bypass the rate limiting?