Imagine one of these no-click zero-day iMessage exploits, but instead of taking over your phone it opens a share link and adds a gallery of illegal photos to your own device or cloud storage.
Also, if you have full access to somebody's phone, it does not matter if Apple is scanning for CP or not, you can do much more sophisticated things.
Also 0-day non click exploits are not something random scriptkiddies running around with dropping CP on random phones as they are way too valuable.
> there is no additional gain from going though all the hops
The only thing I could see would be getting the victim locked out of their iCloud etc accounts with little/no immediate recourse, as from what I have read the process seems to be to lock their accounts as the CP detection alert is sent to law enforcement.
> Also 0-day non click exploits are not something random scriptkiddies running around with dropping CP on random phones as they are way too valuable.
I agree, 0-days are the far high end and wouldn't be used for things like this especially by trolls, but I have to imagine there are methods in the lower-hanging fruit levels available to malcontents to sneak content like this onto unsuspecting users devices. Like, custom ringtone/emoji apps and download packs, random QR codes that lead to downloading a place's menu but also a suspect image, or other usual suspects.
Nobody has put down a convincing difference for this attack yet, but people sure do love repeating it.