I'm not in this field so I don't have time to read these documents. But I checked it out, and...from my understanding the document describes that they can't see your passwords because they do on device export+encrypt and new device decrypt+import.

Is it like that in reality? Should be easy to confirm with a MITM Transparent Proxy, someone should try to find out. Just out of curiosity.

It's exciting to find a company like Apple making a mistake, and they do make mistakes, but boy do they have quality software and it's getting better by the day. Just have a look at their SDK and interfaces: uniform and practical.