If a small circle of people only share not-already-known CSAM content among themselves and never share known CSAM material then there is no way that Apple's scheme can catch them.

However, if at any point one of them screws up and shares a known CSAM image, the entire ring can be caught. This is not actually an implausible scenario. See for example: https://twitter.com/alexstamos/status/1424037132201431045?s=...