Why does the scanning code have to run on the device? Why can't it run in cloud only when a device tries to upload something. Then users can just turn off usi

Why does the scanning code have to run on the device? Why can't it run in cloud only when a device tries to upload something. Then users can just turn off using the cloud services and retain their naive notion that what's on their phone is really private. When are we doing to see a cloud service provider that matches iCould and other service providers but promises total anonimty