There have been Linux ports to several now-outdated iOS devices, the most recent being the generation based on the Apple A4 SoC (iPhone 4, iPad 1, iPod 4G). According to the now-defunct iDroid project (the group behind those ports), the reason that Linux (or, more accurately, their bootloader that can load Linux) has not been ported to later devices is that there are no known bootrom or iBoot (iOS bootloader) vulnerabilities.
Surely, though, a boot-up exploit isn't the only way to get a custom kernel running on an iOS device. Every modern, mainstream, locked-down video game console has a Linux port; and, as far as I know, the Nintendo Switch is the only one that does that through a boot-up exploit (the BIOS/bootrom in this case). All of the others have used a
kexec implementation or something else that loads the kernel after boot. (On the Nintendo GameCube and Wii, for example, executables, whether they be for games or homebrew, are given full bare metal access to the hardware, so that isn't really
kexec, as the Linux kernel executed isn't 'replacing' an existing running kernel.)
With as many iOS jailbreaks as there are for running unsigned code in the user space, surely one yields enough permissions to the user for them to insert a
kexec command into the XNU kernel (the kernel iOS uses) and use that to run a Linux kernel. Why hasn't anyone developed that? Lack of interest or is there something technical preventing it? And what is Apple doing that all of these video game console manufacturers cannot figure out?