In the end, this is a problem with _all_ cloud services that do more than just _store_ data. If it does anything with your information at all then it's possible for an insider to look at it.
Technically speaking, you are correct, but so what?
It does kind of sound like victim blaming, but if you store a bunch of cash under your mattress, don't be surprised if someone tries to take it.
Likewise, if you store a bunch of customer data, someone will try to come and take it. If you make it accessible to anyone other than the customer, you can't act surprised if someone takes it.