US law makes them responsible for what they host, to a reasonable, discretionary degree. Literally *every* technology company that I know of scans for CSAM for this reason. Apple is only implementing this for photos that go to iCloud Photos for this reason.

They are surely not required to scan client devices, and that was a foolishly, ill-considered plan (that I still would wager they will abandon), however they absolutely must scan iCloud Photos unless they were technically incapable of doing this. US law doesn't say "you go to jail if you don't", it says "you face enormous liability if you don't".