> It was a claim that since the iPhone isn’t bulletproof then all security must be pointless.
Nobody was ever claiming that. The claim is that because it isn't bulletproof, remote attestation is pointless, since it has a different failure mode where once keys can be extracted the attacker can't be deprived of them, so there is no way to return the installed base of existing devices to a state of being able to trust their attestations.
The best way to do it would make all persistent storage in the device modular so that the storage device can be attached to a device that isn't booting from it which can thereby verify its contents.
Notice also that remote attestation doesn't enable that. The device can never do that itself since if it was compromised it would just display "attestation passed" on the screen without actually doing it.
When the reality is the iPhone is actually quite a good example that great security is possible with enough investment.