I think the reason this hasn’t been done yet is because their implementation comes with benefits like portability and low maintenance when the feature is implemented in just one app and just one part of the code. I think they hoped that patching bypasses in one app is viable and would eventually close most of the holes, but it turned out not to be so simple because bypasses emerged time and time again even with very limited initial access.

You’re not supposed to be able to skip running the wizard. A stolen phone was unusable and effectively had all of these features, but with a single point of failure that has turned out to be more of a problem then the maintenance benefit is worth.