Interesting, wondering why Apple doesn't restrict the queries to its server using a certificate that would be pinned on the devices, etc, so at least you would need a legit iPhone/Mac to be able to do a query?

Are you imagining some certificate unique to each device? What would prevent someone copying it?