Set aside all the technical aspects of this situation, the privacy arguments, the legal justifications, etc for just a moment.
This is becoming a slow roll public relations disaster for a company that touts privacy in it's advertising. We can sit here on what is a fan boy tech geek web site and argue all the technobabble we want about on device, off device, this scan, that scan, hash, human review, cloud, no cloud.
All people who care about privacy hear is that Apple is going to scan their photos. All the iCloud on/off is techno mumbo jumbo to them. It's all static. People don't have time to do a deep dive into stuff like that. They're too busy watching Beat Shazam or Hell's Kitchen and eating pizza.
When the tag lines in your advertising are:
"Privacy. That's iPhone"
"Privacy is King"
"We're in the business of staying out of yours"
and
"What happens on your iPhone stays on your iPhone"
And people PERCIEVE that's not the case, that's a PR and a brand image FAILURE.
The technological or the moral reasons do not matter at this point. This is becoming a colossal egg on face moment for Apple, and they seem to be in denial about it.
Time to punt. Knowing when to make a stand and when to fold is important. Apple should quietly back away from this for now. Maybe regroup and work with other providers to come to an industry wide standard on the issue so they're not set apart like they are now.
They're making a mess of it, which is not what I would expect from the world's most valuable company.