They control the cloud hardware. Information used for cloud requests is deleted as soon as the request is done. Everything end-to-end encrypted. Server builds are publicly available to inspect. And all of this is only used unless the on-device processing can’t handle a request.
If somebody wanted to actually create a private AI system, this is probably how they’d do it.
You can disagree with this or claim somehow that they are actually accessing and selling people’s data, but Apple are going out of their way to show (and cryptographically prove) how they’re not. It would also be incredible fraudulent and illegal for them to make these claims and not follow through.