The bill only creates a voluntary set of guidelines for companies, not a mandatory set of guidelines.
Companies would be motivated to adopt the voluntary guidelines in order to avoid a heap of legal liability, but this would only be a heap of liability by tech company standards and not by the standards of any other industry not protected by Section 230.
In other words, the fourth amendment argument doesn't really hold water. The data collection practices would still only be private actions, not state actions.
I'm not advocating for EARN IT. I still think the bill is terrible because it disincentivizes end-to-end encryption (or more specifically, it incentivizes bypassing it with client-side scanning). But the specific argument that it would make prosecuting child abuse more difficult doesn't hold water.