+1 The idea that it's on device, hence it's privacy-preserving is Apple's marketing machine speaking and that doesn't fly anymore. They have to do better to convince any security and privacy expert worth their salt that their claims and guarantees can be independently verified on behalf of iOS users.

Google did some of that on Android, which means open-sourcing their on-device TEE implementation, publishing a paper about it etc.