So the attacker only needs to get access to your iCloud. Your iPhone will happily sync down photos uploaded elsewhere.

You don't have to be paying for iCloud, either. There's a free tier, so I'd imagine almost all iPhones are using some tier of it.

iCloud account break-ins aren't exactly rare. An accusation, even if false, could ruin an innocent person's life.