My understanding is that Customer Managed CMK in KMS only means that the customer has control over the key operations - like rotation, key policies, IAM policies, etc. AWS still has actual control over the KMS system and full access to the HSM.
This isn't amazon billing data etc (obviously I expect they analyze that carefully given they bring in billions from billing). To ROUTINELY go through AWS customer production datasets is beyond all reason.
How are they trawling through all our buckets and databases without codepaths for access?
Again, they aren't talking about amazon data (ie, billing, support inquiries etc). They are talking about customer production data.