To be quite fair, I think the pinephone is technically inferior in some ways; having a TPM and secure boot would let you make the device safer than is currently possible. But that's orthogonal to it being a walled garden; if users could run arbitrary apps downloaded off the internet, iPhones would still be safer, and if the next pinephone includes a TPM and user-controlled secure boot, it would have most of the same security properties while still being completely under the user's control.
PinePhone SoC (Allwinner A64) does have the hardware needed for verifying boot via TBBR. It's just that no person or distro uses it for that because the key can only be written once. Also IIRC it's vulnerable to bus snooping.
