My understanding is that WebKit is the only rendering engine permitted on iOS as a security precaution, ostensibly taking Apple at face value and in good faith.
Numerous zero-days on iOS have targeted WebKit in the past, and to a large extent this makes sense to me. Browsers have become one of the most common malware vectors in the modern era, which isn’t surprising given their entire purpose is to access and execute/render external code.
Given that fact, and the significant attack surface area that opens up, Apple’s stance, in my nebulous interpretation, is that having any other rendering engine permitted to run in iOS presents an unmanageable number of potential vectors for more widespread malware on the platform. (Arguments about their resources aside, we know adding engineers to a problem space doesn’t scale in linear fashion towards solving those problems.)
Apple’s vocal focus on privacy and safety constitutes a significant aspect of their product marketing, and it makes sense they’d want to walk-the-walk, so to speak, to ensure their product lives up to the claims they make.
Now, given that Apple already have trouble keeping up with WebKit vulnerabilities, it’s believable that they’re being entirely genuine* in arguing against the addition of additional browser engines that they’d need to keep up with, on the grounds that doing so presents a real risk to their product’s core value proposition, and by extension, their users.
*However, it’s also important not to over-ascribe anthropomorphic traits to a corporation, and it’s completely valid to argue that Apple benefit heavily from this narrative. Indeed, both can be true.