You're absolutely right that closed source makes it much harder to verify that software does what it's supposed to do. I'm not sure in the absence of ability to view the source how we can be sure that Apple does what they say. (maybe network packet sniffing? Are there privacy audits? Must it be disclosed in GDPR requests?) I hope someone with the appropriate qualifications is able to chime in on this.

I'm sorry for my poor explanation, and unfortunately I do not specialise in differential privacy. My layman's understanding is that they add noise to the segments of your navigation before sending it to themselves. Once they receive the noisy data, if they average out many samples, the noise is "averaged out" in aggregate statistics. I hope an expert on differential privacy is able to chime in.