You’ve hit on exactly why Apple proposed that client-side, pre-upload CSAM detection which everyone freaked out about.

Instead, iCloud, Google Drive, and similar all rely on being able to hash content post-upload for exactly that reason.