I think they're trying to say that while apple encrypts in transit (upload + download is sftp or some other secure transfer method that can't be eavesdropped on), they don't encrypt at rest, meaning the data is written in decrypted format to disk. Which is a data security no-no for mine and most enterprises out there. They're alleging that if someone got into an apple server, they'd be able to read your data and anyone elses.
Now that might not be true but I don't see apple saying otherwise anywhere obvious. It's not true. I'm pretty sure Google do this though. They retain a level of access to train their ai models and other deep learning algorithms on what you write in docs or the photos you upload.