Another example is that macOS periodically sends records of which apps you’re opening to Apple, due to OCSP cert revocation checks: https://www.howtogeek.com/701176/does-apple-track-every-mac-app-you-run-ocsp-explained/

I realize this is ostensibly to enable a security feature, but if your threat model includes American software companies & oligarchs tracking what you do on your computer, it’s still something to be aware of.

So the other explanation is that apple announced a few years ago that they were going to scan people’s devices for known CSAM hashes and report any matches to authorities.

This was only for icloud photos, and the reason they were considering that was to keep your photos encrypted in the cloud. this way the photos are analyzed locally on your device and kept private, unless they are found to be problematic obviously.

mediaanalysisd isn’t mysterious. It’s a ML process that evaluates your photos and videos and generates description metadata to make them text-searchable. It’s what allows you to search your photos for “flowers” and see all the photos with flowers in them.