It was a scan during upload to their cloud photos system. Everyone else does it on their servers, Apple was going to run the scan before so they didn’t have to ever have them. To not have images scanned before upload, a user would just not have to use their cloud photos service.
The messaging was really badly handled. They almost certainly just scan all the same photos on their servers instead now.