The photos are cryptographically signed in the apple image pipeline so it's not as simple as just AI generating something. That said, I can't see how this is any different to all the other times we have embedded crypto keys in consumer hardware where eventually someone finds a way to extract the key and the whole thing is busted open.
Given the whole private cloud bit, I am assuming they keep the private keys server side and never let them out.
Nobody has breached the Secure Enclave, not sure it’s doable without investing millions in direct circuit manipulation. Seems good enough