Sure it is. This isn't a feature or setting that users check often or ever. Now, their data is being sent without their permission or knowledge.
Since they cannot convince users to enable this feature in good-faith, they are resorting to subterfuge. We know that Apple is vehement about pushing client-side scanning on users that do not want it, I do not believe for a second that this was a mistake or unintended behavior. If this was a bug then it would have been hotfixed immediately to prevent the unintended behavior from reaching any more phones than it already had.
This is illogical. If Apple wanted to engage in subterfuge they would simply compromise the OS.
When a company controls the entire stack either you trust everything they do. Or nothing.
If anything, the lesson Apple might take from this could be "adding the settings toggle was a bad idea, because nobody would have cared about this at all otherwise".