The core problem here is reporting to prevent CSAM (hopefully, it is uncontroversial that doing so is desirable) but rather that this makes on-device snitching on any topic a matter of -policy- rather than -technology-. It is much harder for a government to say, you must implement this large and complex feature, you must keep it secret, etc - especially a foreign government - than it is to say, here are some new hashes, please plug them in to your database that four people have access to. Or to say, please scan all images instead of just those uploaded. Even if Apple wants to right by its users, it is making it much easier for Apple to be compelled to do wrong.

“We promise” is easily forgotten. “We can’t” requires dev teams to change.