I don’t count this as data exfiltration because it only releases data if you are doing iCloud photos sync, which is opt in. iCloud photo sync has also always been recoverable on the server by government request.

So they have always been one software update from non-opt-in data exfiltration and remain so.