Oh you know it was never going to be a one time thing otherwise there wouldn't have been public.
Here's where I'd draw the line. Every phone that a law enforcement person wishes to unlock, must be sent to Apple in the exact same way you would handle evidence or an organ transplant. So that means the LEO has to physically transport the phone to California, by car (since airplane and train's would take the phone out of the LEO's chain of custody) that LEO must enter the secret room at Apple where they upload "special firmware" to the device that does what the FBI wants, that version of the firmware never leaves the room, and never pushed to phones, it only exists in that room. Once unlocked by Apple, the device's password is disabled to allow LEO access to it, and the firmware is downgraded back to the version that was on the device before.
This is overly convoluted, but any such tool has to not only be kept secret, but must never leave Apple with any backdoor in it. This solution is considered more acceptable because even if Apple has the means to do this, it's not being installed on all devices, and isn't remaining on the device to discover how to compromise the security of the device.
That said, it's still better for Apple to refuse to even make such a tool/firmware, because what will happen is that people will just refuse to update the firmware past the current version, and LEO's could force an upgrade to this "backdoor" version... and so could any badguys.