I consider sending anything up to the cloud without user's consent is pretty hostile. Passwords especially. I don't care if they claim it's E2EE; programmers and implementations are fallible and I thought a key part of Apple's whole value proposition is it's supposed to retain control in the user's hands.