Trustzone is on the same die, same physical memory. Presumably they think that it's potentially vulnerable to the sidechannel attacks they mention.

Plus, they want a full, open source, verifiable system which isn't possible with ARM IP.