...

Sure they can. How else do they enable providing access to the content without the user password?

The data is secured against unauthorized access, but unlike zero-knowledge setups where the chain of custody is fully within user control, the user is not the only one authorized. And even if you are supposed to be, you cannot ensure that you actually are.

OF-FUCKING-COURSE the physical drives, and network traffic are encrypted. That's how you prevent unauthorized physical access or sniffing of data in-flight. That's nothing special.

But encryption is not some kind of magic thing that just automatically means anyone who shouldn't have access to the data, doesn't.

For that to actually be the case, you need solid opsec and known chain of custody. Ways of doing things that means the data stays encrypted end-to-end.

The personal backup plan doesn't have that.