Apropos of nothing, I really don't love the construction of this reassurance. This is not actually a reasoned-through guarantee, it's just two things that happen to be true at the same time. But the latter could change at any point, on-device processing does not preclude the device notifying Apple about what it saw.
Also Apple: "we know when you are naked and take decisions for you upon that"
What a clown company.
It an interesting place to be in logistically. A very thin line to balance between two very bitter ends.