> You'd have a hard time verifying that said on-device scanning would only have been run only on iCloud-uploaded content.

That would be precisely as difficult to verify as verifying whether your Apple device is currently scanning your content.