Do they actually have that ability, though? There's a big difference between "the authentication mechanism has access to this API when you're authenticating" and "everything always has access to this API at all times". I haven't seen any indication that this will be generally available on-demand to applications, and Apple's track record on this stuff isn't terrible (largely because Apple isn't existentially dependent on advertising like some other vendors of mobile tech).