FWIW Microsoft already does this for photos you store on OneDrive: https://www.theregister.com/2014/08/07/ms_tip_off_child_abus...
If your photos never go to iCloud, they won't be scanned.
Not a clue. Maybe they're going to make iCloud Photos fully E2E and this is the only way they can keep the CSAM scanning alive? Or maybe they just want to avoid it arriving on their servers at all (but I don't think anything has said matching CSAM photos will not be uploaded?) Or they just want to save some CPU on the iCloud side by punting that down to the phones themselves?
(Or, yeah, this is just the precursor to doing more client-side scanning and the slippery slope cassandras will be proven correct.)