This isn’t actually true. Yes they don’t give you personally the ability to conduct assurance on their controls. That couldn’t scale. But they do allow large corporations looking to standardize on apple tech, governments, and other like entities the opportunity to verify the controls, their effectiveness, and continued compliance. Further they generally have to attest to their controls under a variety of regulatory regimes with third party auditors verifying.

Your startup may be able to weaken or circumvent your controls and no one would know. But is not true of apple.