My understanding is Apple is not scanning photos on the device, but scanning photos uploaded to their servers: i.e. iCloud. I also understand this is the norm f

My understanding is Apple is not scanning photos on the device, but scanning photos uploaded to their servers: i.e. iCloud. I also understand this is the norm for most (all?) cloud-hosted file and photo storage platforms. I can opt-out having my photos uploaded to iCloud (which I do, but not for security concerns). Am I misunderstanding anything?