I'd expect them to get the right equipment for them to operate their business instead of having people use their private cell phones to save my photo id to their personal iCloud account and God knows where else.

It's like you're arguing banks should be absolved of using tls because it's just so tricky.

If your business requires you to handle PII I expect you to have the right equipment and processes to handle it.