Why can't the key switching code already be in the client?
I'm not asking for anything. I'm pointing out what's possible. As for the last sentence, we don't know what their internal procedures are so we don't know what's harder.
Having the key just isn't enough, you also need a traffic copy and break the transport encryption. The latter likely requires rewriting the data stream, and some cooperation from a vendor (maybe not the vendor whose service you are targeting, though). A one-time key leak without access to interception infrastructure is probably not that useful.
Key leaks are also relatively easy to prevent because secret keys are not relevant to investigations, so they never have to leave the interception framework and handed to a human operator. Sure, the infrastructure could be compromised, but that's already an extremely severe issue if you just have metadata in it.
Sure, iCloud backups and photos are technically readable (they're not under e2ee) but policies and procedures exist to allow law enforcement to access them as well.
What you're asking for is that e2ee be eliminated in favor of a process-heavy solution. But at the end of the day, any human-dependent process can be broken by social engineering and a lack of vigilance.
Yes, an e2ee session can be broken by shipping a hacked client update to an endpoint. But that's much harder to accomplish, human- and process-wise, than obtaining the right key from the right person.