I remember reading about a guy who got FreeBSD's "pf" working on an iPad. MacOS used to (still does?) ship with it. They could do it, they just don't want. They'd certainly never let you be the admin of it and block the gazillion telemetry requests they make back to themselves.