Microsoft and Google have been doing that in their online services for ages, but not on your personal devices.

So if I don’t backup with Google Photos or Google Drive, would they be safe for now?

yes theoretically.

They scan things I send them.

They don't (publicly announce that they) scan things on my device.

The Apple feature discussed here is for photos being synched to iCloud Photos. It does not scan arbitrary local content.

> It does not scan arbitrary local content.

Yet.

Before it was "only content uploaded to iCloud is scanned" and now it's "photos are scanned on-device". That's frog boiling that tomorrow easily becomes "arbitrary files are scanned anywhere on the device".

Only photos being uploaded to iCloud are scanned on device for CE imagery. This is the alternative to having cloud storage having broad decryption ability to do scanning in-service (as say Microsoft, Google, Twitter, and Facebook do)

They already can decrypt iCloud photos, why else perform an on-device scan ? If not with the intention to scan all local contents ?

And the matching photo is uploaded upon match. So regardless the photo is uploaded. What's the point again of taking this further step?

That is an EXCELLENT question, fwiw.

They could have just had a local failure. I suspect there were a lot of arguments around this point - should they be making an attempt merely to prevent such content from their servers, or to detect/report behaviors which may be illegal and harmful.

It also scans every photo that an iMessage user sends/receives.