According to some reports they’ve been doing it server side for a while:

https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-...