I understand the sentiment and even share it to some extent, but we should really be arguing against the strongest possible version of claim, which is as follow

I understand the sentiment and even share it to some extent, but we should really be arguing against the strongest possible version of claim, which is as follows: signal-detection theory tells us that there is a direct relationship between the number of correct-detections and false-alarms, and the only way to achieve 0 false-alarms is not to label anything a hit. In the present case, this means not prosecuting anyone, ever. That's probably not a solution you're happy with. Therefore, the argument is one of degree. I agree with you that Apple's CSAM-detection is going too far, and this is what we should be articulating. Chanting "not even one" is not particularly convincing, nor sensible.