There is a giant difference,If you are a developer you might understand this better, it is much easier to have an application behavior setup from a config file

There is a giant difference,If you are a developer you might understand this better, it is much easier to have an application behavior setup from a config file or from a database then from code. So you have a config that looks like scan_everythin = false; and an update would flip this to true for everyone or for special users. Also with the hashes , the check is not done locally so the government will ask Apple "hey check those hashes you have stored against this secret database too and if you find even 1 match send it to us, here is a judge order so shut up and do it". So after this the governments around the world job is easy, they throw hashes to Apple(and fortunately for Apple they can say they had no idea what original photos content was) where before the government would have needed to ask Apple to write new software and Apple could have said that it can't do it without starting a shit storem.