I did a Google search for "Why I hate the T2 Chip", feeling particularly unwilling to do much with one out of the context of a personally owned MacBook Pro (16-inch, 2019). That led me to this old thread.
So, in year 2022, here's what I particularly hate about the T2 chip:
For one, I work in IT. Currently, in the context of the most recent three releases of macOS (Big Sur, Monterey, Ventura), there are three different types of Mac hardware that I'll encounter:
- Intel Mac without the T2 Security Chip
- Intel Mac with the T2 Security Chip
- Apple Silicon Mac
Each of these three almost need to be treated differently in terms of deployment. Working in IT, we're not always the most prompt to deploy Apple's latest and greatest. In fact, it will probably be 2023 before we deploy macOS Ventura. For deploying Monterey on Apple Silicon Macs, I can use a bootable USB drive (or the magic of Apple Configurator 2 based DFU restores). For deploying Monterey onto an Intel Mac without the T2 Security Chip, I can use a bootable USB drive! These are fairly painless there.
However, on an Intel Mac with the T2 Security chip, I need to change my Startup Security Utility settings. No big deal, right? I just boot to any recovery environment, flip the setting to allow bootable media, boot from the drive and then optionally change it back once I have the preferred OS installed, right? Wrong! It requires an admin account to be present and it will often not like the admin account of the OS already in place (it's particularly weird about MDM-created Managed Administrator accounts [a definite minus for the T2 in any proper IT setting]). If you wipe the internal drive, it will not be intelligent enough to realize that there's no OS, and therefore, no admin account.
So, to wipe a T2 Mac returning to you, the IT admin, with macOS Big Sur so you can get ready to deploy it with macOS Monterey, you either (a) have to cleverly concoct a workflow leveraging the macOS Monterey installer's startosinstall command, or (b) install whatever OS Internet Recovery is giving you (Ventura), boot to recovery mode, make the change to allow external bootable media, then wipe and install Monterey and then optionally re-enable the "disallow External Boot Media" setting (which, if you care about security, you probably will want to do). And mind you, depending on how your MDM provider and Apple Business Manager instance are set up, you will likely want to do some time-saving fancy footwork there too. Gross.
I get the reasoning. An x86 or x86-64 computer is host to a TON of OSes out there and, on top of the T2 being so custom so as to only work with OSes wherein Apple has produced a storage driver for (i.e. Windows and macOS), you don't necessarily want a user (or attacker) to be able to start the machine off of simply ANY x86 bootable OS on an attached USB drive. So, an Intel Mac without the T2 obviously predates most of these protective measures while an Apple Silicon Mac is so utterly esoteric and proprietary in its boot functions that the only third party OS outside of Apple able to boot it is a Linux distro created by a rag-tag group of folks with the sole purpose of creating a Linux distro that can be booted on such a Mac. Prohibiting an Apple Silicon Mac to boot from a USB drive accomplishes nothing for security. Nevertheless, the fact that my workload to install an OS that is neither the latest nor the earliest supported by a given T2 Mac - as is often necessitated by the business I work for - is so damn long and annoying compared to the other two types of Mac is...well...enough to make me want to set fire to every T2 chip-based Mac I encounter at work.
Reason number two as to why I hate the T2 chip:
Activation Lock. It's a wonderful anti-theft feature on iPhones, iPod touches, and iPads. It works similarly well and is similarly consistent on Apple Silicon Macs. It's cludgy as hell on Intel Macs with the T2 chip.
In fact, I could buy a Mac Pro or Mac mini [or refurbished "MacBook Pro (16-inch, 2019)" for that matter], go through the setup assistant, add my iCloud account to it, turn on Find My Mac, use it for a week, then wipe it, and the next person would be none the wiser that Activation Lock/Find My was ever enabled on it (unless they know to look in System Information). The fact that it's turned on would do nothing from stopping someone from using the computer or setting it up or wiping it. It WOULD stop someone from trying to check it into Apple or a third party AASP for a repair. But does it stop the machine from being used or set up the way it does on an iPhone, iPod touch, iPad, or Apple Silicon Mac? Not at all. The reasoning behind this makes sense. Activation Lock is a byproduct of the Apple Silicon of the device (i.e. A-series, M-series SoCs). And, in all fairness, Activation Lock DOES work on a T2 based Intel Mac. Just not for macOS. It DOES work with bridgeOS. And anytime you restore bridgeOS, your T2 based Intel Mac will prompt you for the Apple ID associated with Activation Lock for that Mac. But you're not wiping or reconfiguring bridgeOS on a T2 Mac anywhere near as often as you might wipe macOS on an Apple Silicon Mac. It's grossly half-baked.
Now, if I buy a T2 Mac and am its sole owner, there's no issue. Even on the worst day ever, this will not impact me. However, if I buy a T2 Mac and then sell it, I need to be that much more on top of making sure that I sign out of Find My Mac and that Activation Lock is turned off. If all goes well (and it often doesn't), I can verify that by wiping the Mac and seeing if Activation Lock is turned on in System Information. Otherwise, it becomes messy. If I buy a T2 Mac second hand, then I have to make extra certain that the previous owner turned off Activation Lock before handing over (again, not as automatic of a concern given that, with traditional wipes, Activation Lock being enabled at all isn't easily apparent). On an Apple Silicon Mac, it's obvious and makes sense the way it has for iOS and iPadOS for nearly a decade. On a T2 Intel Mac, it's cludgy as all hell, disjointed, and only really makes sense if you're an Apple hardware nerd (which, you shouldn't have to be as a Mac user to begin with).
Do I hate that the T2 prohibits flexibility with other OSes that the pre-T2 Intel Macs traditionally had? You betcha. Do I hate the lack of SSD data recovery options in the event of a main logic board failure? Totally. Do I hate that removable SSD modules on T2 Macs that have 'em such as the iMac Pro, the 2019 Mac Pro, or the higher-capacity 2020 27-inch iMacs can't be interchanged without a full DFU restore of bridgeOS? Of course. But I'm used to these things by now (and it's not like these are things that are any different in the Apple Silicon era of Mac computing).
But simple crap like loading the previous macOS release (because it's late November and the company you work for isn't ready for the one that just came out yet) and things like Activation Lock being ever-cludgy and half-baked? I'll enjoy my MacBook Pro (16-inch, 2019), but hell if I want any other T2 Macs in my life with those annoyances.