Don't have to assume. If they reset your iCloud password, they're in. They can also see the contents of your backups unless you enable the encryption.