This article is a few years old, but has more of a plain-English, third party explanation: https://appleinsider.com/articles/20/01/21/what-apple-surren...
Its fair not to trust Apple or any company, but Google and a lot of companies were scanning the cloud versions without the negative press Apple got. My understanding is Apple proposed scanning on-device because images were encrypted in the cloud. Uploading and have manual review process seems like a big ongoing cost.
Personally, I dont think Apple is doing anything with photos it stores in the cloud.
Like the first article says, technically they could, because they store the encryption key for user-convenience. Turning on Advanced Data Protection should take away their ability to decrypt photos. But there are a whole bunch of caveats if you're talking about all cloud their data and that has changed over the years.