Correct but this means all content if iCloud is enabled, Photos doesn't give you an option to create a folder or album where you can store your photos on-device only.

You also can't have drop in replacement alternative cloud provider if you are not OK to be scanned and reported to the authorities for government disallowed content(There's no technical reason for the reported content being CSAM only, can be anything) because alternative apps can't have the same level of iPhone integration with iCloud.

> Correct but this means all content if iCloud is enabled

That's a pretty big distinction between all content and all content on it's way to iCloud.

> (There's no technical reason for the reported content being CSAM only, can be anything)

Now we're back to all sorts of assumptions. There's also no technical reason Apple can't scan phones right now.

Apple did say at the time the hash db would be checked against different sources to prevent random content checks. And now with E2E, Apple's proposed method was more secure than what happens in the various clouds today where LEO could show up and ask them to search for anything.

Obviously the most secure is not to check at all, but the law may force the issue at some point.