Google [1], Dropbox [2], Microsoft [3], and many many other Photo Cloud storage providers have implemented similar child porn detection.
[1] https://www.columbiatribune.com/story/news/crime/2021/03/22/...
[2] https://gizmodo.com/dropbox-refuses-to-explain-its-mysteriou...
[3] https://www.local10.com/news/local/2020/02/21/microsoft-aler...
This is the text of the current law [1]. Alerting authorities about CP is required if discovered. Actively searching for CP is not required. Look for the aptly named "protection of privacy" paragraph.
This doesn't explain the insistence on scanning all images on device, whether they're hosted on iCloud or not.
The moment for leadership from Cook has come and almost passed. It's surprising watching Apple squander its brand at this moment. A good amount of its previous support with respect to federal antitrust has permanently dissipated.
They're only obligated to report if found, but they don't have to proactively scan (yet?). In the EU until recently they weren't even allowed to voluntarily scan.