Furthermore in principle there's no reason this has to be, or will be, just CP. First it'll expand to blatant terroristic images, say ISIS beheading type videos. Then it will progress to subversive material: COVID "misinformation", "domestic terrorism" (read: anyone the feds don't like), the list goes on. This tool and its successors will be used to completely abolish the concept of device privacy and will be used to ruin the lives of anyone who sufficiently pisses off the feds. And that's just in America, god knows what they're going to do with this system in China.
2. This article only provides evidence to say Apple will scan photos you upload into iCloud. Scanning local photos is your speculation.
3. The operation of NCMEC and the blacklist is defined by the Federal government. American (citizens) have some mechanism to oppose this design. Apple could perhaps lobby against it, but their lobbying operations are famously minimal.
4. In principle, Apple could do anything. That doesn’t really inform what they’re likely to do. Just like in principle, anyone could slip a malicious content scanning patch into the Linux kernel (and this already has a POC!).
As others mentioned, privacy erosion only goes one way. This is a frontier being breached, i.e. searching your physical device without a warrant, and as usual in the name of CP (the alternative typical pretext being terrorism). It won't take very long before this gets extended to any illegal activity. Gay dating was an illegal activity until not so long ago. This sort of chinese-style monitoring is not desirable in any way, and I find it appalling that Apple seems to want to be the sponsor.
Apple’s system is less invasive in that the screening is done on the phone, and “only if there is a match is notification sent back to those searching”, said Alan Woodward, a computer security professor at the University of Surrey. “This decentralised approach is about the best approach you could adopt if you do go down this route.”
Don’t need to MITM when you put an M at an end.
If they get a subpoena and then maybe send some kind of file list/checksums they've been required to hand over to some 3rd party / government? That's possible, but an entirely different situation.