TLDR They were considering shipping a phone that had already been restored from a backup via their cloud servers.

IIRC iCloud backups have already been the target of both hackers and law enforcement activity before.

But more generally, if whatever service you use for backup isn’t end to end encrypted, then whoever has your backup could sift through it if they wanted.

Note that Apple does allow “Advanced Data Protection” which includes end-to-end encrypted backups along with the warning that Apple cannot help you if you lose your password.