Apple cant do this passively/on demand, as upgrading the OS or Secure Enclave requires the user passcode. Of course the new OS/Secure Enclave firmware could remove this restriction, but generally these sorts of requests are reactionary