I don't think they're saying that. I read their statement more like "someone might build an insecure browser", which isn't that invalid a concern I think. I'd like Apple to be a bit more daring and just open up those APIs too, but I kind of get their incentives point the other way. Apart from some landmark design decisions, Apple is an extremely conservative company, and stalling on an issue like this is just what such an org would do.