Are they not? I would've thought that with Apple advertising privacy and security they would at least encrypt iCloud uploads.

Apple has the decryption keys to iCloud... It is one of those things that many people assume the other way given Apple's marketing and PR stands.

I for one am aware of this with iCloud and am still using iCloud for convenience (and by choice). If I were in need of better privacy, I can always use the iPhone without iCloud, and it will work. After this "in phone" watchdog implementation, that will not be the case. I will assume that Apple is constantly watching all my unencrypted content in the worst case, on behalf of state actors and intelligence agencies.

We have seen Apple give in to the Chinese government spying because it is the law there. US government could easily ask for this and also apply a gag order preventing Apple from being able to tell the user. The best situation is to lack such a tool.

iCloud uploads are encrypted in transit and on their servers, but they are not E2E encrypted. Apple has the decryption keys

If so they flubbed it.

If they are e2e encrypted they can't be distributed/shared without giving a key of some sort. Why not just scan them at time of distribution, and treat undistributed files the same as any local hard-drive (i.e. not their problem).

This system could still work with an e2e encrypted cloud library. However, it’s currently not e2e.