> This puts often overlooked initiatives like GDPR in a completely different light to me.

The problem with initiatives like GDPR is that they don't actually solve the problem. If you're worried about the SS then a law that tries to tell companies what they can do with some data is totally useless, because the thing you need is for the companies to not have the data.

If Apple can run code as root on every iPhone then when the SS comes, the SS can run code as root on every iPhone. They go to Apple and put a gun to their head, or infiltrate the company with operatives, and then do what they please with the central control the company already holds.

To prevent that you need to change the architecture of the systems in popular use to remove central chokepoints that authoritarians could use for censorship and surveillance. But none of those initiatives have accomplished that, and most of them don't even attempt it, even though that's the thing you'd need them to do.

You need "no chokepoints" to be the pre-existing default when the baddies come so that when they try to change it, people can already see why they shouldn't and refuse to give up the existing systems without it. Instead of needing to develop those systems only after the need arises, and then needing to do it under a hostile regime which is meanwhile using the existing systems to commit atrocities.