I don’t know, and I’m certainly troubled by the story.

There is a federal law requiring electronic service providers to notify if they spot such material. Apple may be subject to that. See the “Federal CSAM Law” section here:

https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b...

I assume 18 USC 2258A, but they seem to be going above and beyond. Under current law, they are only required to report, they are not required to prevent[1].

Presumably, they are doing this voluntarily now to stave off future legislation around this that might require more invasive scanning.

1. 18 USC 2258C(c)