How do companies like Apple , Google etc secure the keys they use to code sign binaries that allow them to run on Android or iOS ?

And how would they be able to mitigate the keys being stolen ?