As a Senior System (just one?) Engineer and Solutions Architect yourself, if you have years of experience the first thing you should conclude is that we simply do not have enough information.
What exactly happened in more detail? What are you system specs, what version of Windows 11, what patch level, what software do you have installed, what security software is installed, wired or wireless, how many times did it happen, can you reproduce it......etc....etc.
What we have is a single report, plus the friend backing it up, either one or both accounts are new and NOTHING else.
Sure, we can all hypothesize what we think it could be, and I as a 32 year systems (as in more than one) enthusiast/engineer/architect and now Sr. IT manager of Infrastructure and Security....would agree that if it is happening as stated, it would probably be a server side issue. While I really like Apple products, I have used Windows since version 286....some 32 years ago when I was in the US military and still do today. Both are good at the things they do well, and I use them both every day.
That said, my years of experience would make me ask for way more information if this was brought to me before jumping to conclusions. Some people on here are practically foaming at the mouth ready to burn down Apple and iCloud over a single report by Joe Internet, in website forum that is driven by clicks and ad revenue.
MacDaddy, I have made an edit to my typo of "System" to "Systems". My sincere apologies, for I was swiping away on my iPhone keyboard single-handedly whilst on a train. I hope you and the 20,000+ systems I have administered have mercy on my soul.
Anyhow, I completely agree with you on the "need more information". It could be a hoax to start panic and fear in people using iCloud Photos. However, I feel you missed my point completely. Though to be fair I didn't articulate my intent, because to me it is irrelevant.
If this indeed is a real issue, the statements made by
@crispingob are false.
Again, I will repeat, you CAN NOT blame the client OS or application from accessing information that it shouldn't be able to in the first place. If the client side software or OS has a bug which unintentionally allows it to exploit an external system, the external system has a bug/exploit that needs to be patched. In other words, even without the client side existing at all, the server software still has a vulnerability.
Therefore, you can't make daft comments like "Windows sucks its all because of Windows"
EDIT:
I'll also add (just for you)...
"What exactly happened in more detail? What are
*you* (I'm of the Homo Sapien class system) system specs, what version of Windows 11, what patch level, what software do you have installed, what security software is installed, wired or wireless, how many times did it happen, can you reproduce it......etc....etc."
Ah yes, basic troubleshooting that I expect from level 1 helpdesk role.
Now assuming this is a real bug for the sake of argument.
Even if you were to go through all that, it wouldn't be the client side at fault, because the client side should never be able to access information that isn't intended for them.
To elaborate further, it doesn't mean that it's the iCloud servers either.
For example, the fault could be because you are in an environment that's using an iCloud caching server. The random frames of other users content could simply be other local users cached data.
If this was the case, it could mean there's no fault at the Apple server side or the client side, but instead a bug with the caching service running on a local Mac mini (as an example). Troubleshooting if this occurs when connected to the LAN (with the caching server) or via the WAN (no caching server) would obviously assist in finding the fault. But again.... not a fault of the client endpoint.