Is there any legitimate purpose of PT_DENY_ATTACH? It seems to me like it would only have evil uses.

I could imagine _some_ arguments for it back when it was first introduced (first reference I can find to it is from 2004) — this was pre OS X Sandbox, let alone SIP. It makes sense that some OS X apps would want to prevent being debugged by other (potentially malicious) apps. Semi developer-hostile in my opinion, but I get it.

That being said, on modern iOS... the benefit seems pretty minimal. Even Apple agrees https://forums.developer.apple.com/forums/thread/701621