> The point of the feature is to prevent people from using iCloud to distribute CSAM.

Right, which is why it's so utterly baffling that they don't do this scanning server-side instead of client-side.

Why flag the account and report it if the only goal is to politely prevent people from uploading? Like you say, a “code change can do anything” and we simply don’t know how the current feature is done or how it will evolve.

edit: like many comments here already say, reporting doesn’t sound terrible for CSAM, but nothing about the feature guarantees it wont be extended to other kind of content.