See the article iCloud security overview - Apple Support
End-to-end encryption
For additional privacy and security, many Apple services use end-to-end encryption, which encrypts your information using keys derived from your devices and your device passcode, which only you know. This means that only you can decrypt and access your information, and only on trusted devices where you’re signed in with your Apple ID. No one else, not even Apple, can access your end-to-end encrypted data. End-to-end encryption requires two-factor authentication for your Apple ID and a passcode set on your devices. Some features using end-to-end encryption may require up-to-date software.
If you forget your password or device passcode, iCloud Data Recovery Service can help you decrypt your data so you can regain access to your photos, notes, documents, device backups, and more.
Say if iPhone is lost , the when passcode is enabled , find my is activated activation lock automatically turns on , the person can never open the passcode ( its a screen lock ) , so if they pretend you as account holder they can never verify the account while talking to apple advisors and decrypt , the account credentials are identified by senior apple care advisors asking account credential questions from the calling person .
See the article If your iPhone, iPad, or iPod touch is lost or stolen - Apple Support
From the lost iPhone the iCloud back up can't be done to Mac / computer , the actual device must be in possession .
However , you can sign in with account credentials of Apple ID account used in iPhone from browser at www.icloud.com and view what is stored in iCloud .
