> hostile entity from switching it off on unsuspecting users
I agree it's likely to prevent third parties from messing with the setting, but not hostile third parties specifically. Think of a VPN app or file sharing browser extensions who might want to disable the relay "to be helpful".
Because a truly hostile entity capable of changing local settings can already obtain the device's real IP and also capture traffic, the two things private relay is meant to prevent. There would be no point. If anything it might increase the odds of detection.
Apple often plays a game where they blend security and business interests, but represent it only as a security interest.
They own the OS and could do for private relay like what they do for screen recording: when it's in use, overlay an unhideable visual indicator that it's that it's in use. Make it visually obvious when it turns off.