A sophisticated hardware attack is probably going to be government sponsored anyway in which case that government can just request data from Apple directly.
On the other hand, by not making it an option, Apple annoys power users and others at the extreme tail of the distribution. These users write about it in the tech press and Apple gets a black eye there… But Apple has always been criticized in the tech press so it doesn’t really change anything.
I make encrypted iOS backups to my computer. Happens automatically when I plug in my phone. Data never touches the cloud.
Also Apple does use E2EE for some iCloud backup data like Health, and Keychain (passwords). If you lose access to all of your iDevices you can't recover that data.
I totally agree that Apple should just make all iCloud backup data E2EE. Given that users already lose some types of data from their backup when they lose the key, that doesn't seem like that much of a barrier. Supposedly the reason they're not all E2EE is because of pressure from the FBI[0]. But people like me that care can still have encrypted backups.
[0] https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
I wish they make a iOS Time Capsule for that.
Client-side CSAM detection would allow full client-side secrecy unless there’s a pattern of in-violation imagery destined to be sent (presumably E2E encrypted and thus undetectable) to iCloud.