They started making in-roads to making iCloud E2E encrypted, but the tech community lost their minds about it and they backtracked.
Client-side CSAM detection would allow full client-side secrecy unless there’s a pattern of in-violation imagery destined to be sent (presumably E2E encrypted and thus undetectable) to iCloud.