To be upfront, this is academic for me because I believe Apple should comply with this specific order. However, I think this is probably the most complicated and nuanced case-study on something like this we've probably ever seen so I'm interested in exploring some of the potential arguments to see if they hold any water. To set the common level, I have a pretty comprehensive understanding of the technical aspects of this issue. I'm definitely not a lawyer though.

---

I think iOS devices are set simply to reject untrusted certificates unlike Android devices (someone correct me if wrong), so it's just there in this case to certify that just this stuff is actually from Apple, not that it's not malware.

Not totally. While signed software can mean that, in this case, Apple restricts the iPhone from running software that isn't signed by Apple. Apple openly says this signature is how they prevent malicious content from running on your iPhone.

this stuff should only really be created and flashed to the subject phone in this one case

That still doesn't change the argument that it changes what their signature represents. Also, I believe there will absolutely be more cases. Apple will have to roll new code for those devices but they'll have to sign that code all the same.

In the case that a dickbag gets their hands on it as a corporate saboteur or some such, I think Apple should have a reserve certificate to replace the compromised one as soon as they have wind of that and revoke it ASAP

Not quite. Revoking it would mean updating the certificate revocation list. They wouldn't be able to do this until an iOS update. This would mean that every phone, except for ones on the newest iOS, would be vulnerable.

However, this argument against this is totally invalid anyways. I imagine Apple will protect this software just like they currently protect their signing certificate. The assumption should be that anyone who could get the software could also probably get the certificate which would negate the need for the software in the first place (since they could now sign their OWN code).