Christensen says that once a particular product attribute or performance measure becomes "good enough" for the average consumer, then additional, sustaining improvements to this attribute won't be valued in the marketplace and therefore won't drive future sales. See Concepts page and discussion of Clayton Christensen. When it comes to mobile connected devices, one product attribute taking on growing importance is privacy and security. For the average consumer privacy and security is probably never good enough. Consumers want companies to make it as hard as possible to steal personal data.
There's one caveat: improved privacy/security has to be easy for consumers to adopt and implement. If improvements to privacy and security are easy to adopt, then they will be used and valued and won't overserve, since privacy and security (by themselves) are never good enough. If improvements to privacy and security are difficult to adopt, then they won't be used and valued and will effectively overserve. The key is whether sustaining improvements to privacy/security are easy to adopt and implement.
And this means Apple has a long runway in making sustaining product improvements to privacy and security, as long as these improvements are easy to adopt. As an integrated company with a closed ecosystem, Apple is in the best position to innovate and make sustaining privacy/security improvements that are easy to adopt across multiple devices. It's going to be more difficult for modular companies with open/incomplete ecosystems to make these kinds of improvements.
Privacy and security may be the single most important product attribute when it comes to the "Internet of Things." Consumers are going to want mobile devices that pay for things, unlock doors, start cars, and control thermostats to be really secure.
The author owns stock shares of Apple.