Note that in this case, the "untrusted" party is the cloud provider, not the user. It's meant to attest servers. Fortunately newer intel consumer-class processors don't support SGX anymore.
Nothing in this prevents servers from discrimincating against clients that fail to produce TPM-backed attestation that they run exclusively the exact software builds, cryptographically signed by a central arbiter of trust, that the server expects/requires them to.
Also note that servers running in the cloud can naturally be clients. It's only bad if this is meant to restrict the power of the consumer over their own (non-rented) devices.
Also, Arm silicon, for example, has TrustZone, which afaiui serves a similar purpose as SGX did.