Wow, that seems really obfuscatory. It's implausible that they only have a vulnerability to iPhone devices, but I guess that's the line of argumentation they'd use to limit the fallout. Sucks to be cellebrite.
Edit: it seems like they downloaded the file from Apple's site. The order says using the IPSW file was fair use, and that doesn't appear to depend on them downloading it vs shipping it. I don't think that makes a different. The cellebrite usage is also fair use for the same reasons (doesn't compete with Apple, transformative usage, etc)