I agree with the conclusion, but the argument is wrong. Remember what apple refused to do was create software that would allow it to workaround the limit on password guessing so the FBI could brute force the device password. The fact they refused implies that they *could* create that kind of software. Presumably, nation states like China could -- at least with access to the appropriate apple secret keys -- create the same kind of workaround. A system where apple used a secret key on an airgapped sealed cryptographic module to create per device law enforcement decryption keys would be no less secure.
The real danger is the second you create that legal precedent apple isn't going to be able to pick and choose which law enforcement requests it complies with -- be it from some random judge who issues the order ex-parte (say for a device image taken without your knowledge) without you having the chance to contest it or a request from judges in China. The danger here is mostly legal not technical.
Indeed, the greater hacking risk is probably someone hacking into a local police department and changing the account ID requested in a warrant and then getting access to your icloud backups that way than hacking a well-designed system that allowed apple to issue secondary per device decryption keys to law enforcement.