> I get it, the mechanism they're using has apparent flaws, and maybe some whacko could somehow get access to your phone and start uploading things that trick the algorithm into thinking you have CP.

Whatsapp by default adds all received images into Photos. So all it takes is to send you few dozens of pictures while you're sleeping.