I do wonder why Apple chooses not to lock down the Mac to just Mac OS like all their other hardware? I'm sure the sales from people who intend to run something other than MacOS look like a floating-point error on the scales Apple operates.
Just not publishing the specs is enough to delay so much the effort that those machines are out of warranty and have depreciated so much by the time they are supported that they aren't competitors to the mac ecosystem anymore.
There are plenty of other ways they can be less open and hackable than Linux but it can never get to the point of the iPhone.
If I may offer a slight consideration? “arbitrary code vs arbitrary signed code”.
What’s realistically stopping Apple from requiring all code and processes be signed? Including on device dev code with a trust chain going back to Apple and TPU / Secure Enclave enforcement