That is the where of the story. There was a inarguably confusion over the when, what, and how of the story.

It was not universally understood that this would only apply to photos sent to iCloud.

It was not universally understood that this was only looking for previously known CSAM.

It was not universally understood that they were using some sort of hash matching so photos you took yourself would not trigger the system.

I understand if you consider the where more important than the others, but it is simply a fact that there was confusion on what exactly was happening here.