How is then law enforcement getting what they need from people's iphones? Because I understand they do, in some way. And I'm not asking about forcing people to hand over pin or fingerprints, but just by themselves.
Here is one example how: https://news.ycombinator.com/item?id=47716490
Lockdown Mode is focused on reducing the attack surface from Safari including the WebView and Apple services including iMessage/FaceTime. It does nearly nothing to protect against non-browser/non-messaging attack vectors in the OS or other apps. It's up to app developers to implement similar restricted modes and also baseline exploit protections. App developers need to explicitly opt-in to using the standard exploit protections used in many parts of the OS and Apple discourages doing it:
https://developer.apple.com/documentation/Xcode/enabling-enh...