Additionally, you can and should encrypt your data which Apple allows to do using FileVault.
Again, the encryption key never even reaches Apple‘s servers except if you use the iCloud Keychain. And even if you do and you store your key there, Apple wouldn’t have the key for your iCloud Keychain and thus couldn’t do anything with that data.