Hardware mitigations which you can’t use?

I'm pretty sure they're talking about things like PAC, which are are definitely available to apps (and I think even required?).

Not for third party apps, the ABI is not stable yet.

Regardless of the actual usage surface, its need is seen as relevant enough for Apple management to release the necessary budget to spend in engineering to make it happen across the whole stack.