Sure, F-Droid. It's an app store that not only is exclusively foss, they only host things they can build from source in house and seem to have a decent review process - they tag anything from ads to integration with paid services, and those features are often buried so it seems like they're pretty militant about it
It comes with all the drawbacks that entails, but I generally check there first myself
They got in the phone anyways, Apple just told the FBI to pound sand if they don't have a court order... Why would they put man hours towards decreasing their reputation if they don't have to? They're probably not even geared to break into their own devices. Then their PR team ran with it while one of many companies with the capability to crack the phone took a paycheck
This is different - this is genuine security, even if easily bypassed with preparation beforehand. Honestly, I credit some random apple dev who may have been looking to fix a bug related to long uptime as easily as they might've cared about security. I don't think this was even on the radar of Apple leadership
This isn't some moral superiority on Apple's part, but it is good practice