This isn't cryptographic though. That would make the entire database absolutely trivial to bypass with tiny imperceptible random changes to the images.

It's a perceptual hash.

It cannot be a cryptographically secure hash, simply because avoiding detection would then be trivial: change one channel in one pixel by one. Imperceptible change, different cryptographic hash.

The tweets talk about perceptual hashes, not cryptographic hashes.

But the probability is still not zero, and the number of iPhones in the world is large. A hash collision is possible, however unlikely.

The probability of Apple and all its devices winking out of existence due to quantum fluctuations is not zero. ‘Not zero’ is effectively zero if the number is small enough.

128 bit hashes are “expect your first collision when each human buys 2305 iPhones, all with one terabyte storage, and then fills them up with photos that are an average of 1MB in file size”

https://en.wikipedia.org/wiki/Birthday_attack

http://www.wolframalpha.com/input/?i=2%5E64%20%2F%20%288e9%2...