Apple was generating (something)@icloud.com whenever you used that service.
Now, it will use (something)@private.icloud.com instead. So you can ban this subdomain instantly, knowing people will be "hiding" with this service by default.
It's like blocking anondaddy, simplelogin etc but not protonmail.
You are questioning the method when people just see the need.
If you're an engineer, no matter what you say about the method, you know a country at war will make you lose all your savings. Or if you're a foreign citizen in a country that will seize your assets, even "by accident".
They lost thousands of emails and they treated every customer individually while blocking people from complaining on their subreddit.
Then, it was posted here on HN and they finally decided to stand up and fix their reputation by saying they care and want to do better, after months of silencing the issue as much as possible.
What if I need cron in my docker container? And ssh? And a text editor? And a monitoring agent? :P
Thankfully LXD is here to serve this need: very lightweight containers for systems, where your app runs in a complete ecosystem, but very light on the ram usage.
It's like blocking anondaddy, simplelogin etc but not protonmail.