There should be integrity protection on the SoC, and then all other components should be untrusted.
Sure, that means someone can proxy the fingerprint sensor or put on a fake screen that shows a fake consent dialogue. But I think that is an acceptable risk - after all, you can never protect against someone making an entirely new device that just happens to look like an iPhone.
And I think it is unacceptable.
That doesn't mean that you also have to think the same thing, but I would rather not have that option taken away from me. I also don't think that you have made a case for any similar-security implementation for integrity protection.
I think distributed trust is the only way to make trustworthy components, and the only known-good way to do that is using PKI, and the only proven way to do that is to have a CA.
> [..] after all, you can never protect against [..]
That's the kind of thinking that gets you stuck in "we have already lost so we should stop trying".
If you can make sure that your finger print never leaves the secure enclave, and you can make sure that the Secure Enclave cannot be replaced, you can trust the device a whole lot more than a fake security measure that can be circumvented at every stage. What is the point of an insecure security control? You don't send your passwords plain-text over the internet, do you? Just because TLS is imperfect, and your CA store can be compromised, and your screen might be recorded using a camera and a telescope doesn't mean that therefore we should stop improving TLS...
If you're uncomfortable with the idea of buying potentially backdoored hardware, what makes you comfortable using backdoored software? I don't understand the "hardware matters but software doesn't" threat model. It certainly doesn't benefit you in any pragmatic sense, the best it will do is give you warm fuzzies while Apple adds your OCSP data to a running tab for your iCloud account.
If you are really on the spectrum of 'trust nobody', then what are you doing here on the internet? You had to trust your GPU, your window manager, your browser, the network stack, your internet provider, the server this site runs on, the people who own it etc.
The specific threat being protected against (leaving aside the increased safety of iPhone users by making the stolen parts market untenable) is your phone, that you recognize and use as your phone and which contains your confidential material and credentials, having internal components swapped out while unattended.
It's probably also some form of PR and brand protection, and part of platform security as a whole.
I doubt that any commercial company would find the side-effect of less end-user tampering a true downside; if the device says "I have been tampered with", that's a very clear signal that someone coming in for some warranty repair has some explaining to do.
And even that should be possible to disable the same way Android allows bootloader unlocks.