They canceled their plans for client-side scanning. They do scan content on their servers. Therefore whether your data in iCloud Photos is scanned depends on whether Advanced Data Protection is enabled or not. It’s disabled by default. Enabling ADP will turn on E2E encryption and disable account access via iCloud.com.