It's widely been stated including by Arm that architectural license holders must still fully comply with the Arm Architecture Reference Manual. Apple's Arm cores do not.

In what way are they non conforming?

Dozens of different ways. New instructions, new privilege modes, VHE mode in EL2 can't be turned off, etc.

Obviously some of those are intentional architectural deviations, but is there a good reason to believe the stuck HCR_EL2.E2H bit isn't just an errata?

None of those are exposed to applications or in open source, are they?