True, but that line of thinking assumes they will harden those things in favor of the customer/user.

The article suggests that Apple may be exempting its own apps from user-defined network traffic protection measures in order to clamp down on geographical licensing loopholes, or to keep its app traffic out of VPN servers. Either case would be to the benefit of Apple and the detriment of the customer/user IMO.

No, not at all, when compared to Linux.

If you think Linux has no trade-offs in terms of security then you probably overestimate the security work that is invested into a lot of packages.

I know very well how much vetting is done in Debian, and how little is done by most distros.