There's a distinction between "secure for users by default" and "secure from users"
Apple (and Apple fans) really like to muddy the two.
You can build a perfectly secure ecosystem by default... that still has an escape hatch (covered with warnings) that the user retains the right to use.
Apple chose in its mobile ecosystem, and continues to choose, not to do this.
Ergo, what they're really in favor of is "security from users"
PS: To head off the 'users are the most insecure part of a system' apologism, (a) we're talking about personal devices, not managed ones & (b) with great power comes great responsibility.
I.e. Google only implements Play Integrity (nee SafetyNet) attestation. Third parties decide what to use it for. Google has no control over those third parties.
That said, in practice it's 90% about controlling and limiting open source / third-party Android forks.
The thing that gets most on my nerves is the ridiculous "protecting users security and privacy".
Because if I go along this line of thinking then the conclusion is that they don't give a damn about it on the Mac line because there I can install what I want.
It's not up to Apple to decide how I use their products and I will never ever buy their phones albeit I need to use one to test mobile websites and applications for work.