Most of the process is done on customer's devices.[1]
[1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
[1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
To be clear each image, the image’s NeuralHash, and a visual derivative are uploaded to iPhoto. This allows for the inspection of the NeuralHash algorithm used which I actually prefer.
The phone isn’t downloading the hash database.