If they have the data, and can supply the data in readable form, they may be legally obligated to provide it. Not much else you can do at that moment, if you're Tim Cook trying to stay out of prison.

Apple is clearly working toward securing that data so they can't supply it in readable form. Hard to reconcile that with excellent usability & UX, but they're solidly heading that way. Encrypting that iCloud backup such that it [mathematically] cannot be used without the Secure Enclave is surely coming. To wit: "here's all the data we have, only the defendant can unlock it, and no we're not building backdoors in."

If a company doing business in the US receives a legal warrant from a judge requiring them to turn over information they have access to, pretty much any company has to comply. So this isn't surprising, or even that worrisome that they turned that over. Everyone would.

The trick, of course, to preventing government surveillance is for companies to just not have the data in the first place.

I think that (among other recent events) spurred their recent advancements, making less and less of our data accessible by them at all.