This discussion got quite long without anyone mentioning the novel technical implementation paper "Scalable Private Search with Wally". Kudos to Apple for researching this, but shame on them for enabling this by default.

As a somewhat homomorphic encryption scheme, each query releases some bits of information on what you searching for to avoid using the whole database. Subsequent queries from a given user will generally be correlated enough to build a tracer. Governments or other powerful enough actors can pierce the proxy veil, heck the tracer will be able to deanonymize you with enough queries recorded.

How many queries? For me it is too tedious to work out the math from the differential privacy definitions and I already know the landmarks around me: I don't want such a feature.