That "only" is doing a huge amount of work in your comment. Turning my device into something that snitches on me is a huge difference from scanning my uploads.
If you send any of those illegal photos to Facebook, Facebook will snitch on you. If you send them to iCloud (under this described system), Apple will snitch on you. It is no different to "scanning your uploads" because it /is/ "scanning your uploads". That it's the CPU in the phone doing most of the work and iCloud servers making the connection, vs Facebook's CPU and cloud doing all the work, makes zero practical difference to anything.
Arguing about where in the combined system the processing happens is shifting the deck-chairs on the Titanic, it's not making one part of the system more or less responsible than any other part.
