Unless you explicitly enable Advanced Protection mode for all your devices, Apple stores your key in their servers and will give it to whoever legitimate looking asks for it. Aka ICE etc will definitely be granted access.

I wouldn't trust E2EE implemented by an entity against itself that can also push arbitrary updates in principle. Also, any E2EE product that has a non-E2EE mode seems prone to accidental leaks.

I don't think that's true for HomeKit Secure Video (HKSV). Advanced Protection turns on E2EE for various iCloud services like iCloud backups and Apple photos. But HKSV is already E2EE'd and the decryption keys aren't part of the device's iCloud backup. At least that's my understanding. I believe health data and the iCloud keychain is similar.

> Unless you explicitly enable Advanced Protection mode for all your devices

This is very easy though, you just go to your iCloud account settings under the settings app and enable it. It should be on by default imo, but I understand the argument for why it isn't.

Either way, enabling it is not a barrier and ICE cannot be granted access once you do unless you yourself give them that access.

Home data is always E2EE https://support.apple.com/en-us/102651