I'd happily pick cloud based scanning. At least that way I can opt out by not using their cloud. I have serious doubts that choosing not to use iCloud will actually stop Apple from running scanning code on my device. Having a capability pretty much ensures that it will be used, and likely misused.