Almost all other cloud services scan when you upload to a server. That is standard practice. What apple is doing is moving the hashing process to your phone. It not only scans photos but scans messages " if under 13, and turned on, wink wink." As the program would need admin permission to run. It is by definition a backdoor.