Metamask responded, with a Twitter thread starting with this Tweet:
π If you have enabled iCloud backup for app data, this will include your password-encrypted MetaMask vault. If your password isnβt strong enough, and someone phishes your iCloud credentials, this can mean stolen funds. (Read on π) 1/3