If you don't trust them to scan things on your device why are you trusting them to scan things in the cloud and why are you trusting them with both the hardware and software you run?
2. When scanning is done locally, it’s easier for them to secretly or openly modify the software to scan everything on your device, rather than just what’s just uploaded to iCloud. If they tried scanning everything (including non-iCloud images) in the cloud, the network traffic of uploading every image on your device to the cloud would be observable.
Where was this promise stated in these explicit terms, especially the definition of "personal files"? Because Apple is also promising that this only applies to file that are set to be uploaded to iCloud and the expectation of privacy is different for files uploaded to the cloud.
Either Apple's promises can be trusted or they can't. And if they can't, you can't trust anything about their devices.
Of course it is not an explicit promise and doesn't refer to "personal files" but I think it shows where OP is coming from. You can reasonably understand this message in the way they do.
You want "What happens on your iPhone to stay on your iPhone"? Turn off iCloud.
The marketing speak is marketing speak and obviously not literal.
Auto-sending all your photos to a server owned by someone else (and without end-to-end encryption!) by default cannot be described as "what happens on your iPhone stays on your iPhone" in my opinion.
They push arbitrary software updates to your device at their whim, therefore they own your device.