It wouldn't add security anyway. In order to encrypt data, they first need to read it unencrypted. Thus, they can't advertise iCloud as "we can't see your pictures", because they can, in theory.

You must mean something else here. Data certainly may be encrypted twice. In that case it would need to be decrypted twice in order to be useful. Perhaps you meant to say that data must be "unencrypted" in order to perform some other operation, e.g. generating thumbnails.