It's interesting how everyone used to be all in favor of Apple's strategy of doing all photo analysis on the device instead of on some remote server, and now it's reversed. Suddenly Google's approach is better?
The advantage of doing analysis on your device was supposed to be that your data never left your device. Now you get the worst of both worlds, with your device doing the analysis but your data leaving anyway.
Nothing changed. The issue is the same for both situations: possible communication with remote servers.
If the scanning here was happening and merely notifying the user, there wouldn't be a problem. Or course, it would be completely useless to catch criminals.