I don't believe this is entirely true. One can obtain lots of sensitive info from Webkit exploits and app-specific exploits, without ever touching iCloud. Alexa app is one such example. It can access your camera and mic without you knowing.