Apple isn't a monolithic entity. For example, a rogue engineer might be able to access your iCloud data, but it's orders of magnitude more complicated to push a specifically manufactured app to your device.

There's a similar variance of complexities for hacking and law enforcement overreach scenarios.

E2EE isn't a solution for all attack vectors, but it's a significant mitigation in itself.