I think the biggest concern for the average person would be feeling like the promises of Apple privacy would be severely compromised by this, regardless of whether that’s the case.

I didn’t realize it at the time, but apparently all iCloud backups are encrypted? So either Apple was thinking of grabbing an unlock key from somewhere to decrypt before sending you the phone, or they were just going to include an encrypted backup file (or something) that you’d have to enter your password to unlock upon receipt (and then presumably wait for the decrypting).