passwords and pass keys are in the iCloud Keychain, which is end to end encrypted. iCloud photos are not.
Well, we don’t know yet. We don’t even know for sure if these photos are from other people’s libraries. Some comments above have some theories, but IMO we should wait for Apple to say something, or more data to be available.
not quite, though. The public part resides with the service you are using (like github), whereas the private part resides on the device and in the iCloud Keychain, which is end to end encrypted.
although in this case it’s not “iPhone” but rather a cloud service for photo storage.
by “in iCloud photos” do you mean via the web client? Because after syncing down to other devices, they play just fine.
iCloud Photo Library isn’t.
You can just delete them. Sure, you need to trust that Apple actually deletes them. If you don’t, I guess don’t use their services or even products.