Well, putting aside that CSAM isn't active at all at the moment, you're correct it didn't apply to iMessage (sending an image in iMessage couldn't trigger it unless the user saved the image), and that iCloud Photo Library needed to be on.