I would expect them to get to iCloud via this attach chain even with advanced data protection on. Which means if you are targeted, they not only get data from your iPhone but also all the data you backed up to iCloud from your other apple devices. I suspect they would be able to compromise apps like 1Password through this. Which means all services whose password and 2FA is stored together in 1Password is compromised.

It is good to know lockdown mode stopped this attach chain.

Given this has happened so many times, new security posture for a normal/regular security conscious person should be:

1. Disable iMessage.

2. Enable lockdown mode.

3. Disable iCloud. (If you choose to keep iCloud enabled, definitely enable Advanced Data Protection and disable iCloud Web, disable passcodes and keychain on iCloud. Disable iCloud mail – it uses 3rdparty proofpoint for scanning – more surface area for compromise).

4. Don't store password and 2FA together in the same system like 1password. Always use FIDO2 physical key based 2FA, if available.