We don't actually know because they never shipped the feature. But having iCloud enabled was not a required part of their scanning system, it was simply an if-else check, and we just had to take their word for it that they wouldn't scan anyway.
Still, even if the scanning was only if iCloud was enabled, that's still a step too far in my book because Apple makes it very difficult for alternate photo backup apps to work well. iCloud uses background syncing/upload in ways that third-party apps are prevented from using.
It wasn’t scanning. They took a fingerprint of every photo and encrypted it so only if that fingerprint matched on the server side and only if 5 of those matches occurred, they could view a photo thumbnail.