Apple already did scan photos on your device, though. They do a massive pass of ML classification over all photos on a pseudo-regular basis (I assume "whenever

Apple already did scan photos on your device, though. They do a massive pass of ML classification over all photos on a pseudo-regular basis (I assume "whenever a new OS release includes a new ML classifier build") -- it's what makes things like searching for "cat" in Apple Photos work. If Apple's willing to change the new system to do a full scan of all photos on-device and send notifications to them outside of the upload-to-iCloud-with-security-tickets mechanism, they could just as easily have done that with the old system.