The problem is not that they are doing this for CSAM images. It's well intentioned. The problem is the backdoor that they've opened.
Imagine this scenario. The FBI is trying to find someone very specific. They contact Apple but Apple holds its ground and gives a firm "No". Fine right? Do you think the FBI will stop there? No of course not, they will go to the NCMEC and have them upload a set of images. Chances are, they won't even bother with Apple, they'll go directly to the NCMEC and start finding people of interest.
Now replace FBI with another country's government. Say, the China, and the pictures are sets of pictures from the Hong Kong protestors.
Now replace China with a bunch of hackers who hack the NCMEC.
Lots of things can go wrong here