Unless it's planted. [0] Or sent to you. [1] Or (farther out there) happens to be embedded on a site you visited and ends up in your browser cache.
[0]: https://www.nytimes.com/2016/12/09/world/europe/vladimir-put...
[1]: https://www.nytimes.com/2019/06/17/nyregion/alex-jones-sandy...
You don't have to be paying for iCloud, either. There's a free tier, so I'd imagine almost all iPhones are using some tier of it.
iCloud account break-ins aren't exactly rare. An accusation, even if false, could ruin an innocent person's life.
i was quite surprised to see this was the default or at least was setup unknowingly to me.
I know multiple people (most of them in their 50s or older) who started paying for iCloud because they thought it was their only option.
Or are you saying that malicious activity is only interesting if it was on an Apple device?
https://www.macrumors.com/how-to/see-photos-shared-with-you-...
On top of that, at this stage you are right. How long before they move it to every file in your device's storage "because of the children!"