I'd rather like to have the "source" of iOS/iCloud client and verify if they behave as they claim.

I'm always curious how can people get so confident about Apple's security practices, given that none of the parts are open source? Is the trust solely reputation-based?

I've been seeing comments on HN praising how Apple respects users' privacy etc. Though I have a genuine question: how can we be so confident that Apple follows their claims while their software remain closed-source?

For client-side Google software like Android/Chromium at least we got to fork and remove the evil bits; we have built thriving communities based on that and everyone's got an alternative to Google. In the case of iOS/Safari do we trust Apple-provided binaries solely based on claimed policy / reputation?