Just wanting to be a gatekeeper doesn't cover measures like SIP that don't make them anything and presumably took immense man-hours to implement.

I think the more accurate view would be an intersection of some of the company wanting to make money off gatekeeping and some of the company wanting to make quality devices that stay functional and malware-free even after you give to a deeply gullible grandparent for a while, and the former using the latter as a transparent excuse much of the time.