There's a lot of reasons but IMHO the engineering answer is that the firmware is stored on the SSD, not on a random SPI NOR sitting on the PCB. So rather than having to support a wide variety of SATA controllers or do PCIe training (because few vendors implement the spec well so you gotta do a bunch of hacks to get it to work), they have a single storage controller that the SecureROM talks to. Then LLB and iBoot bring up more and more of the storage stack. Apple documents some of it here:

https://support.apple.com/guide/security/boot-process-secac7...