You don't own the device, nor the OS, and that is the element these searches are going to run out of. You own a license to use the hardware and the OS. While your data is your own, they don't need permission to run anything off it.
Android is the same way.
---
Honestly, as a father of 4 (four) kids, when I saw this, I was relieved, and thankful Apple is taking steps to weed out people that have the horrible practice of preying on our children.
I was appalled to see so many ignorant responses about the subject, and granted I feel that, on a topic as delicate as this one, it should have fallen to the journalist to do due diligence and explain deeper how all of this works fro a granular point of view, to see panic at bay.
Nobody at Apple Park is going to sit down flipping your photos or your nudes. It's all code. Only if the scans for hashes match what is in the CSAM DB, then the content will be copied to somewhere to be reviewed by other algorithms, if those algorithms determine that the content in question is a positive, then further development is carried out.
And honestly if you have any photos who's hash is on that DB, excluding a false positive then I don't know what to tell you... go hire a good lawyer... move to the moon.