While Android users are effectively locked out, iOS users, even those running older versions, have more flexibility.
This is what I’m not understanding: are they doing user-agent sniffing or perhaps using a proprietary JavaScript API? Couldn’t de-Googled browsers just pretend to be iOS (as ugly as that would be)?