That used to be a core principle but might not be guaranteed anymore. Depending on the implementation it can be near impossible to bypass modern hardware backed security. As it should be!

The policy issue at this point is that users effectively aren't in control of their devices anymore.