There is a shared (among all of the major tech companies and presumably law enforcement) hash database of child abuse material. Going from a photo to the hash is deterministic: How it gets to a hash on your phone is surely the same way it gets to a hash running the exact same algorithm on the cloud, whether iCloud, Amazon Photos, etc.

Such a collision would generate a human validation.

This applies to cloud-shared files. It actually has applied to cloud shared photos for years. It applies to literally every major cloud photo service.