The files that iCloud Photos stores are encrypted to your account and Apple can't access them. Apple scans the images on your phone so that this can continue to be the case, but they're doing a perceptual match - i.e. determining if this image looks like a modified version of the original image (e.g. if it's just been resized or re-encoded or something).
This way Apple can scan for CSAM without having to actually violate privacy by scanning a user's images themselves.
> The files that iCloud Photos stores are encrypted to your account and Apple can't access them.
This is false[1]. Apple can decrypt them, and they can decrypt them and send them to law enforcement should they get subpoenas. They're encrypted at rest with keys that Apple has.
I recall a court case where a police officer was convicted of possessing CSAM on his computer. The files were encrypted so the prosecution was not able to view them, but they were able to demonstrate that the encrypted files contained known images, I believe by encrypting a known image with the same public key and demonstrating that the result was binary identical. Obviously this wouldn't work except for unmodified files including cropping, scaling and editing metadata.
This way Apple can scan for CSAM without having to actually violate privacy by scanning a user's images themselves.