Before it was "only content uploaded to iCloud is scanned" and now it's "photos are scanned on-device". That's frog boiling that tomorrow easily becomes "arbitrary files are scanned anywhere on the device".
Only photos being uploaded to iCloud are scanned on device for CE imagery. This is the alternative to having cloud storage having broad decryption ability to do scanning in-service (as say Microsoft, Google, Twitter, and Facebook do)
They could have just had a local failure. I suspect there were a lot of arguments around this point - should they be making an attempt merely to prevent such content from their servers, or to detect/report behaviors which may be illegal and harmful.