“Because this feature is not used by the firmware, we have no idea how attackers would know how to use it.”
The 0-click iMessage chain used four zero-days against iOS up to 16.2, and the attackers went after Kaspersky’s own researchers. One step wrote to undocumented GPU coprocessor registers on A12 through A16 chips and walked straight past Apple’s hardware kernel memory protection. Those addresses appear in no device tree, no firmware and no public source. Somebody knew Apple’s silicon better than the documentation does.