How do you verify that? :) You're just quoting what apple says. Which may be all they're allowed to say due to the national security letter thing.

I'm trusting in the hacker community with this.

If Apple really is trying to sneak in a CSAM database on your phone with iCloud disabled, someone WILL catch it and raise so much hell we'll all hear it.

iOS is open source now?

Network sniffers are.