Forbes had the only evidence based reporting where they cited a court case where Apple automatically detected known CSAM in attachments to iCloud Mail: https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-a...

Everyone else is making inferences from a chance to their privacy policy and a statement made by a company lawyer.