Yes, thank you. This is the only theory that explains observed reality. I'd add that they probably consider the scheme to be better than the alternative (which

Yes, thank you. This is the only theory that explains observed reality. I'd add that they probably consider the scheme to be better than the alternative (which is how others do it, including Google IIRC), namely checking photos once they have been uploaded. They have gone to some lengths to do more on the device instead of uploading user data, in Siri for example, but also Photos.app face recognition etc.