Except that this is all about analysing files that are not on iCloud, but on the device. So what is on your phone is now being reported to people who might decide to trash your life. Hardly "staying on your iPhone".

That is not true if you read the technical details. Scan applies for files (and only for those) which are prepared to be uploaded into the cloud.

If you don't trust that, that is another story. System is full black box.

Yes, but it happens on your iPhone. So what happens on your iPhone isn't staying on your iPhone like they said it would.

So when I said:

Am I missing something more than "but it's happening on-device!"?

Your answer is "no".

I think you're deliberately missing the point here.

It's not whether it happens on-device, off-device, in the cloud, in the tubes, or anywhere.

It's that Apple said that they would not do this, and now they're doing this. You can make technical quibbles that what they promised was slightly different to what they're doing, but they're irrelevant. The core promise of "what happens on your iPhone stays on your iPhone" is being broken. It's that breaking of the promise that people are angry about. Does that make sense?