Given that it’s already scanned server side, you could literally do this to someone now. Both cases (client or server side checking) simply require getting a user to download it to a location that auto syncs to iCloud.

If this was as big an issue as people think, we’d have seen more of it.