Apple can decrypt data stored on iCloud, and they scan it already it seems:

https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-...

Which it what makes adding the client side functionality even more problematic. They can easily extend this to scanning all offline content.