Also, the matches are supposedly only to actual babyporn pictures. We have 0% way to verify that, as even employees of NEMSEC are not all allowed to view them. Such DBs are often full of unreviewed fluff, and why not unrelated photos entirely, cookware, computer cases, who knows, as long as “some degree of matching” with your photos allows Apple to send a .zip to the police.

In terms of the privacy intrusion, what difference does it make whether the images are scanned on your device or on their servers? They're getting scanned just the same either way.

But if they did it on their servers, it would provide a technical impediment to expanding beyond the use of iCloud, and remove the need to trust Apple as much. That seems like it would be much better for users while still allowing the functionality they claim to be seeking.