Literally everything already, they're authoring and flashing the firmware.
They could enable 24/7 recording, lie to the OS about what is happening and trickle the data back server-side within harmless iCloud requests. It would be pretty much undetectable.
And the point of CSAM client-side is that it is more secure and private than them doing it server-side.
What can be more insecure and not at all private than scanning user files using user's computer resources? Server-side scanning is impossible if E2EE.
You see this as a simple trusting apple because they have complete control over the OS/Hardware. I see this as a culture shift that goes beyond trusting any particular company that fundamentally erodes privacy.
Of course, they could lie and scan everything, but as others pointed out, they could do that already anyway.
As much as I oppose client-side scanning, having a single global hash database makes it much harder for a company to do special favors without anyone knowing.
Would you mind expanding upon that?
The fact that you have a phone in and of itself is traceable, as cell phone towers maintain records of who, when, and where. At this point, usage of such records is so commonplace by LEO that not having your phone with you when you do something is considered suspicious in and of itself.
Advocating against Apple force-updating a phone that you haven't bought seems... silly in comparison? Especially as only with an up to date OS, you can be sort of safe against attackers, be it state level sponsored or regular ones.
As opposed to opening the phone, plugging the cable, doing whatever you want and shrink-wrapping again? (which is easy)
"Oh but it's wireless" It's through the wireless charging mechanism. That makes the whole difference