Isn't it more like "literally any LEO or pseudo-LEO in a 'friendly' country" at this point based on what we know at this point?

I think the threat model here is less about a hostile actor subverting the backups than the extreme ease of access to all data on those systems that is given to law enforcement?

Yes but as a user you don't control this. That's the problem. Anyone you're talking to can activate cloud backups and there is no way to know.

or until LEO or State Security compels / sidepushes a trojan app update via play store update. It's as trivial as that. Or just tap the baseband chip via the provider.

>Only nation state actors might be able to do that.

Nah, all it takes is a good spear phishing campaign like the iCloud celebrity nudes leak a few years ago