In fact, I believe iOS uses hardlinks for this, as it is possible to save a 40GB video on a device with 64GB storage instantly - while logged out of iCloud and without an Internet connection.
Since hardlinks are used, there is likely no way to tell the original and copy apart except by their paths. The photo-rescuing algorithm that shipped in 17.5 probably wandered around the filesystem farther than intended, possibly via mds.
So Apple is probably not stealing your photos. If it is, this bug is not evidence of it.