If it transpired Google or Apple had staff looking through people's cloud photo backups, yes this would be considered a violation because "cloud backup" is framed as a personal solution and not a hosting or processing solution.
It's not the same as doing this systematically (like Meta here), but these are shades of gray. A serious privacy law would prohibit both.
Sadly that means it is not enforced well since it is too broad to be enforced in a meaningful way. And therefore it is violated A LOT, both by companies or people since no one can be bothered!
AVG (GDPR) includes the following things as personal data: name, address, phone number, passport photo, information about someone's behavior on websites, allergies, customer or staff numbers, recognizable recordings and more.
Rule of thumb, any information that can be used to relate a specific person.