They could enable 24/7 recording, lie to the OS about what is happening and trickle the data back server-side within harmless iCloud requests. It would be pretty much undetectable.
And the point of CSAM client-side is that it is more secure and private than them doing it server-side.
You see this as a simple trusting apple because they have complete control over the OS/Hardware. I see this as a culture shift that goes beyond trusting any particular company that fundamentally erodes privacy.
Of course, they could lie and scan everything, but as others pointed out, they could do that already anyway.
What can be more insecure and not at all private than scanning user files using user's computer resources? Server-side scanning is impossible if E2EE.