Apple and iCloud encryption keys A friend of mine was arguing that Apple’s staunch pro-privacy and pro-security branding is disingenuous since they hold iCloud encryption keys. 

To what extent is this true or an oversimplification?
iCloud is an umbrella term that encompasses a number of Apple services. How Apple handles encryption for various aspects of its services is detailed here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Most relevant is the section on Internet Services, starting on p. 49. In general, keys are tied to your device(s) which are protected by your passcode (that only you know), and hopefully also with two-factor authentication. 

If enabled, iCloud "Keychain items are transferred from device to device, traveling through Apple servers, but are encrypted in such a way that Apple and other devices can’t read their contents." Keychain Recovery is optional, and in the absence of two-factor, is protected by an iCloud Security Code that only you know.

iMessage is end-to-end encrypted using device-based public-private key pairs: "Apple can’t decrypt the data." Same for FaceTime.