They not going to go through Apple if they planted CP on your device, they going to take you to custody saying they got an anonymous tip or something along this line or just tip off the police to do the job for them because it worked in the past, requires less effort and maybe I'm wrong on this but there is no additional gain from going though all the hops when you can do it with an anonymous call.

Also, if you have full access to somebody's phone, it does not matter if Apple is scanning for CP or not, you can do much more sophisticated things.

Also 0-day non click exploits are not something random scriptkiddies running around with dropping CP on random phones as they are way too valuable.