Have you considered the number of client-side SDKs surreptitiously doing things on “your” mobile device?

One of the most common is “scanning” your location constantly, feeding your daily routines to marketing data aggregators, which is arguably more invasive of the average person’s privacy than CSAM flagging.

I’ve posted in the past a list of a short-list of offending SDKs frequently phoning home from across multiple apps from multiple developers. Since weather apps sending your location surprised people, I thought this problem would get more traction.

This Apple thing, where this is iCloud file upload client SDK doing a thing on upload, is an instance of this class of problem.

It’s not an Apple thing, it’s a client SDK thing, and the problem of trusting actions on “your” end of a protocol or cloud service is not a solved thing.

I fail to see any difference, when your data is as much "yours" whether cloud backup is turned on or off. Google and others scan data stored in Drive (and other cloud storage) not just for CP, but for copyright infringement, etc; even files not shared with anyone. Someone here just yesterday complained that Google in 2014 kept deleting personal files of ripped DVDs from their Drive. Given that many people use GDrive/OneDrive/iCloud as their main storage, where most of their PC files are stored in the cloud, I fail to see any logic in making a cloud vs personal device distinction.

Right before it's uploaded to their servers...