Right... it's one thing to for example, use a third-party MEGA client to upload files so that there's no chance of the company ever being able to see your key (unlike random javascript they might inject into the web version).

But when Apple etc. control both ends, their app could always see your data locally because it is the one that encrypts it to upload to the server in the first place. And these companies can receive secret orders from the US government to add backdoors into the local app and there's nothing you can do or say about it, except go out of business (like Lavabit).