Agreed, we should be careful not to champion them as the saviours of consumer privacy just because they have lately been marketing themselves as an improvement over Google and Microsoft.
What are they doing that other vendors aren't? From what I can tell their privacy-forward marketing began with the rollout of the Secure Enclave in the 5S, but Android vendors were already using hardware key stores and full disk encryption at that time.
I will admit that this action to change the advertising ID to default-off is a promising one though.