Read the papers published by Apple. The target database is (intentionally) designed to make it impossible for Apple to know what the targets are.

This is a complex cryptosystem designed to keep Apple out of the loop. There is a target database whose intended targets they cannot know, and customer data they prefer not to know.

Yes but they review the matches! It is the same thing in the end: if apple reviewers start to see that a bunch of political pictures are being flagged they will realize that the system is no longer being used to flag CSAM content.

The database distributed to phones is just hashes. By itself it can't be validated.