Backups with Advanced Data Protection also enroll:

* Recovery Keys

* Recovery Contact (someone who holds your recovery key in key escrow)

right, the ability to recover implies keys exist outside the device. even if they gossip keys to other devices you control, there are lots of people with only a single apple device.