Apple's proposed system does not scan all the pictures on the device, only images about to be uploaded to iCloud. A picture in an email would not be uploaded (whether visible or not).

Even if uploaded to iCloud (such as pictures sent via WhatsApp by default), and above the threshold, they would still be scanned by a second algorithm and subject to human review. So, your "very simple" attack fails on at least three counts.