There are definitely risks with cloud storage but a lot of the calculation depends on what you store. I keep my password safe on Dropbox but it is heavily encrypted. My photos are in multiple cloud locations but noting sensitive there. I also keep my PC "Documents" folder (and its sub folders) backed up online so that stuff is at risk but it would take a pretty sophisticated effort to make much from it. I avoid keeping truly sensitive stuff on my PC (Account numbers and passwords, SS info, banking statements, etc.) so the biggest danger I could foresee is someone combing thru every little thing they could steal trying to gather social engineering info for identity theft. But my credit is locked down with the pins in the encrypted password safe. And I suspect identity thieves can get better and more relevant data from other sources that we can't do anything to correct (e.g. the Equifax breach). I used to keep local backups but I dumped them because it just seems easier and a reasonable tradeoff to move to the cloud.
I like Bruce Schneier on security. He had this to say a few years back:
Security Trade-offs of Cloud Backup
This is a good essay on the security trade-offs with cloud backup:
iCloud backups have not eliminated this problem, but they have made it far less common. This is, like almost everything in tech, a trade-off:
Your data is far safer from irretrievable loss if it is synced/backed up, regularly, to a cloud-based service.
Your data is more at risk of being stolen if it is synced/backed up, regularly, to a cloud-based service.
Ideally, the companies that provide such services minimize the risk of your account being hijacked while maximizing the simplicity and ease of setting it up and using it. But clearly these two goals are in conflict. There's no way around the fact that the proper balance is somewhere in between maximal security and minimal complexity.
Further, I would wager heavily that there are thousands and thousands more people who have been traumatized by irretrievable data loss (who would have been saved if they'd had cloud-based backups) than those who have been victimized by having their cloud-based accounts hijacked (who would have been saved if they had only stored their data locally on their devices).
It is thus, in my opinion, terribly irresponsible to advise people to blindly not trust Apple (or Google, or Dropbox, or Microsoft, etc.) with "any of your data" without emphasizing, clearly and adamantly, that by only storing their data on-device, they greatly increase the risk of losing everything.
It's true. For most people, the risk of data loss is greater than the risk of data theft.
I suppose a sensible approach for somebody who is extremely worried about data breaches would be to encrypt everything locally and keep encrypted copies in the cloud. You still need to have a way to share your keys in case you die or are incapacitated.