This Apple Support Article outlines Apple's online data protection and encryption. This arsTechnica article covers iCloud data encryption and concludes:
Originally Posted By: arsTechnica
The simple answer is that your data is at least as safe as it is when stored on any remote server, if not more so. All data is transferred to computers and mobile devices using secure sockets layer via WebDAV, IMAP, or HTTP. All data except e-mail and notes—more on that later—are stored and encrypted on disk on Apple's servers. And secure authentication tokens are created on mobile devices to retrieve information without constantly transmitting a password.
which is better than I thought and makes me feel a lot better about my data from an APFS (Encrypted) drive that is mirrored on iCloud.

That said, I will continue to keep passwords, credit card and financial information, etc. in 1Password and/or Evernote for their additional layers of encryption, because these applications run on both MacOS and iOS devices. While I cannot access that from a public computer, I always have my MBP, iPad, or iPhone with me. If I traveled internationally and especially in the third world I might have to rethink the availability of my backup data.

If we knew what it was we were doing, it wouldn't be called research, would it?

— Albert Einstein