> they can just use/switch to unpatched devices with some opensource e2ee without big effort.

Assuming no new zero-days, and that they were even doing best practices in the first place. How many legit companies do best practices?

zero days are irrelevant imo, zero days are for targeted attacks(assuming it's from gov), exploiting all zerodays for all devices is not that productive, csam scan on the other hand can handle both untargeted and targeted surveilance: untargeted by spotting bad actors from a generic csam list, targeted - by adding to that list target's face/specific things to locate it and monitor it.

That's the point, bad actors can circumvent the system if they feel threatened, but system can be exploited by gov/companies once rolled out globally to target any user, so we get something that may be not that effective against bad actors but poses great risk to be misused by gov/company in their own interests without users knowing. I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.

I don't buy your argument, but as for:

> I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.

As per my last sentence in my initial comment in this chain:

--

> And the governments will rub their hands with glee with all the new data they have access to.

Is 100% still the case, and almost impossible to get anyone to care about.