On device != Scanning your device. It scans your iCloud uploads and if configured, iMessages (which you didnt mean, because that doesnt work with hashes)
The general worry is that the fact that it happens on the device means in the future it could conceivably scan your device, even if there are some software checks in place to only scan things being synced to iCloud.