This would mean that when backed up in Apple’s servers l, they’d have to backup per device... maybe they do?
Backups are different. Those are not encrypted with device keys because obviously you want to recover from loss of device and restore to a brand new one. But if you’re not comfortable with that, you can do local encrypted backups with your own password via iTunes. And as noted the most sensitive data like HealthKit is only included in encrypted backups. White paper also discusses a special escrow service for backing up your keychain, incidentally.
My foggy understanding is that iCloud backups are encrypted with a key stored in iCloud Keychain, which is encrypted within the hardware security module escrow service they run, so after iOS 10 they can't actually decrypt your backup.
Edit: oh, I replied to you below as well. That video has the details but it's been awhile since I watched it.
It sounds like (although I'm not an expert) that it would still be impossible for them to encrypt files in higher data protection classes, since the iCloud backup keys are stored within iCloud Keychain, which is end-to-end encrypted.
Edit: and honestly if I'm misinterpreting that and it's an issue for a specific person, they should just use iTunes encrypted backups and not rely on iCloud.
“When files are created in Data Protection classes that aren’t accessible when the device is locked”
So not photos, most data.