Ok, so you posit an attacker could find/generate 30+ pictures that are 1. accepted by innocent user, 2. flagged as known CSAM by NeuralHash, 2b. also flagged

Ok, so you posit an attacker could find/generate 30+ pictures that are 1. accepted by innocent user, 2. flagged as known CSAM by NeuralHash, 2b. also flagged by the second algorithm Apple will run over flagged images server side as known CSAM, 3. apparently CSAM in the "visual derivative". That strikes me as a rather remote scenario, but worth investigating. Having said that, if it's a 3-letter adversary using Pegasus unhappy with a journalist, couldn't they just put actual CSAM onto the journalist's phone? And couldn't they have done that for many years?