If that was the case they'd just implement it on their own servers, just like everybody else (it's not like iCloud is E2EE).
In reality they probably have a "photoscanner.so / .dylib" that currently is only linked in by the iCloud uploader thing, but at any time could be called in by any other part of the system (or offer exploits new avenues for data exfiltration), which was actually spelled out in their initial announcement (there will be a system API for accessing it).
So they absolutely have the ability to scan photos on your phone; the fact that they don't intend to currently use it outside of the iCloud uploader is totally immaterial to this debate (the thing I don't want on my phone is photoscanner.so or any such capability).
In reality they probably have a "photoscanner.so / .dylib" that currently is only linked in by the iCloud uploader thing, but at any time could be called in by any other part of the system (or offer exploits new avenues for data exfiltration), which was actually spelled out in their initial announcement (there will be a system API for accessing it).
So they absolutely have the ability to scan photos on your phone; the fact that they don't intend to currently use it outside of the iCloud uploader is totally immaterial to this debate (the thing I don't want on my phone is photoscanner.so or any such capability).