For most of it, yes. There are exceptions, e.g., Health and Keychain, for which Apple does not have the keys even without ADP enabled.

Yes, otherwise, how would the web interface (iCloud.com) work?