Most of Apple’s iCloud is not end to end encrypted:
As such Apple holds the keys, and at times accesses your data and shares it with governments, or as per Snowden and CCP revelations shares an indiscriminate copy on ingress with certain governments.
I consider my location data sensitive, as such would like access to only explicit parties, rather than society implicit parties.
How does Arq do the backup? and are they protected in any way in which it requires a key or a password from me to access?
Arc’s iCloud Drive backups are done by saving the files to the local iCloud Drive folder on the phone, which iOS then syncs to Apple’s servers using end to end encryption.
As you say, Apple still hold a key, and are able to unencrypt it and share it with governments if they so choose.
If that’s a concern for you, you could perhaps do manual JSON exports instead, so that you can save the files locally on the phone then choose where you store them yourself. You can do this from the timeline view, tap the options button (…), switch to weekly or monthly range, then choose Export, Export timeline as JSON. That will export the full data for the month you’re viewing.