I really don’t understand how you can, with sound mind, compare a public facing ‘social media’ with my very personal and very private phone photos. These are two completely different things.
Scanning publicly accessible material makes a lot of sense and is within the boundaries of section 230, tech companies are responsible for policing removing illegal or threatening material. For private or encrypted information, section 230 does not apply.
The purposes these services were designed for matters. iCloud is meant to be private, facebook would prefer everything you post is public as it’s built in to benefit their business model. Facebook should scan, iCloud shouldn’t. You are purposely obfuscating that detail.