I do agree that most people probably don't change the defaults, but I believe that apple stopped the scan for CSAM years ago on iCloud.
https://edition.cnn.com/2022/12/08/tech/apple-csam-tool
Also you forgot to account for apps like Signal which store the photos encrypted in their own database.
This is not as simple as scanned photos, currently apple for example can do this locally on their own apps. The problem is apps like signal.