It only scans images in your iCloud Photo Library. Not paying for iCloud? No scanning. Not in your photo library? No scanning. And even then, only for known content, not new content.
Conveniently, iOS 15 also syncs images from your messages and many other places into your photos. Whether this will put that file in your iCloud Photo library, I do not know.
Not only is there a free tier, but the iPhone defaults are cleverly configured so that you quickly fill it up with random junk on your phone, and feel pressured into paying for more iCloud storage, because the default sync behavior is so non-obvious, and the settings to disable it are buried.
I know multiple people (most of them in their 50s or older) who started paying for iCloud because they thought it was their only option.
If this was going to happen, it would have already happened on Android, Gmail, OneDrive, or any of dozens of services which already do what Apple is now doing.
Or are you saying that malicious activity is only interesting if it was on an Apple device?
https://www.macrumors.com/how-to/see-photos-shared-with-you-...
On top of that, at this stage you are right. How long before they move it to every file in your device's storage "because of the children!"