> In reality it costs the bad guys $299 to bypass this limitation

They also had to get verified as a mid-sized or greater corporation (Apple does use real verification partners), and further Apple can pull the rug on the certificate in an instant, immediately invaliding that $299 certificate and the considerable effort that went into getting it.

In reality this group likely had to hack an existing Apple Enterprise approved business first, then using that to springboard to the next step.

Casually dismissing that enormous gate is pretty tenuous.