I have numerous usernames and passwords (Keychain items) that I have input to visit websites on Safari on my Macbook Air, with AutoFill enabled for Safari. They've only been used on my Mac.
I find these have been uploaded to my iPhone. They are visible under Settings > Accounts and Passwords > App & Website Passwords. Passwords are shown by default, in plain text, albeit protected by the 6-digit passcode.
This occurred despite the Mac's iCloud Keychain setting not being enabled (not ever). iCloud Keychain is enabled on the iPhone, although I don't recall choosing this.
I would think that not checking the box for Keychain on the Mac would prevent uploading its information to iCloud. Is this expected behavior?
Macbook Air / macOS 10.3.3 High Sierra
iPhone 6 / iOS 11
Update: only Contacts, Mail and Find My Mac are enabled on the Macbook Air.