Now that I understand your situation, it personally makes sense. Having worked with a client in the medical field for the past few years, I was obligated to comply with HIPAA laws / PHI. Fortunately everything I did was through a remote connection so no files ever existed on my laptop in the first place. But I'm sure others with company provided devices would've taken issue with that, if that were possible.
Indeed, Apple could've handled privacy a bit better, but it's also true that they already handle privacy the best. It's just in your fringe case they somewhat violated. To reflect what I mean @ fringe:
It seems your work computer is a non-managed, personal computer, or hasn't gone through the kind of audit that larger medical facilities' computers would've. The security policies you have in place aren't sufficient for the environment. For a secure computer, logging into iCloud shouldn't be even allowed at the system level (should prompt a security violation even if a person attempted to log into it) and therefore the desktop syncing would be a moot feature that's impossible to use. Then there's other factors, like, in our company which is actually a Windows 7 enterprise environment, it's a rule to not store non-personal files on the desktop or in the profile folders (security permissions prevent the latter). The reason for avoiding profile folders is that, profile folders are the ones that tend to be backed up and most often attacked. The logic is simple, if it's not your personal file, then it shouldn't go into your personal folders. The "Desktop" folder is inside of your personal folders (even in Windows), so that would exclude it from being an option.
Smaller practices don't usually have the luxury or take the steps necessary to ensure their environments fully comply with client privacy laws. Still, I do agree that Apple should have been more transparent about the change. However, it became a problem because of bad habits in the first place, and Apple made it worse. If you had an adequate security policy in place, it would've never been an issue. Apple probably weighed that in regard to their enterprise environments and considered it a non-factor. -- I understand the convenience of having things on your desktop or personal folders, but instead you should create a folder outside of your home directory, and create a shortcut to that folder on your desktop or personal folder (so you don't have to hunt for it all the time). Even if you've already disabled iCloud, anything that's not your personal files, should not be in your personal folders.
Apple, Microsoft, Unix, Linux, BSD, all handle home directories / personal folders the same; so that is a universal rule that's beneficial to abide by in secure environments since all of those home directories in the various systems would be the first point of attack. Also, your webcam should be covered (with black tape or something), and any remote assistance features of the system should be disabled. There's so many other things that should be done, but it would make your system less usable. A personal computer really shouldn't be used for confidential medical work. Perhaps, you could consider getting a dedicated machine that you can remotely connect to using your personal computer. So that you can continue to work through your personal computer, without having to lock down your personal computer to a barely usable state.
Just some pointers / ideas.
I understand your frustration though, because that could've resulted in you being fined or even jailed. *sighs* But you wouldn't have a case against Apple, as you weren't using sufficient security practices in the first place.
