https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

"Before an image is stored in iCloud Photos, an on-device matching process is performed for that image against the database of known CSAM hashes".

Thus the scanning is done by your device against the unencrypted image before uploading it to iCloud. The fact they abandoned the plan is irrelevant, by considering it in the first place (and to a very high level of engineering R&D as evidenced by the document), they set a precedent and forefeited any trust. It's CSAM today, it will be mentions Winnie the Pooh mocking Xi Jinping tomorrow, and of abortion in Texas the day after.

Now, the only way I'd trust an Apple-mediated encrypted messaging service is if the clientapp is third-party and thus can't be backdoored retroactively if Apple feels it expedient to do so.