Despite their goal of enforcing in 2017, it is still not a hard requirement. Back then, about 80% of the apps we tested disabled ATS either partially or fully [1]. It’s rare to see Apple walk something back [2], but here is a blog at the time that talked about it [3].

[1] https://www.nowsecure.com/blog/2017/12/29/enable-ios-app-tra...

[2] https://developer.apple.com/news/?id=12212016b

[3] https://www.klundberg.com/blog/app-transport-security-delay/