Correct. Is that hashed fingerprint you just downloaded associated with the face of a known victim of abuse, or with that of a whistleblower? Impossible to tell.
(The N-Gate scenario is a little different: someone who doesn't like you controls a random app that is allowed to write to your /Downloads or /Pictures folder. Puts compromising material in it, then lets the well-meaning OS scanner pick it up and report you. You spend the next X years wrangling with law enforcement, trying to convince them that you were "hacked", the same thing every criminal claims.)
If the scanner program merely refused to transmit the potential match, it would be acceptable. No avenue for abuse (without shipping a malicious update, which is always possible for cloud-controlled devices anyway), and at worst an annoyance in the event of a false positive.
But I very much doubt that the parties pushing for this legislation would settle for that.