In reality, the fact that they do the scanning on-device is actually better privacy-wise. But I can see how instinctually it “feels” wrong.
If they only scanned icloud I can choose to not use that.
If they scan on my iphone my choice would be to stop using that and get a gphone instead.
Then it only runs client side and alerts if there are matches to CSAM hashes above some threshold.
The other way is it runs against unencrypted images in iCloud and they'd know of any match.
The new method also paves the way for the iCloud photos to be encrypted (they're currently not).
The detailed specifics of this would be interesting to know. If I accidentally flip iCloud photos on and then turn it off within a few minutes, would that give the system license to scan all my photos once? What if my phone is in airplane mode and I turn iCloud photos on? Will the system scan photos and create vouchers offline for later upload?
Edit: On a related note, will turning on iCloud photos now come with a modal prompt and privacy warning so you're fully informed and can't do it "by accident"? Pardon my ignorance if this happens already. I've never turned mine on and am not about to start.
But Apple have circumvented that with NeuralHash. There's no way for the user to verify that only CSAM is being detected - which could be partially accomplished by having iOS only accept hashes signed by multiple independent child protection organisations (with some outside of FVEY).