They use it. Everything you upload is run through either Cloudflare's or MS's CSAM scanning.

Everything.

Wtf do you think CF and MS is doing with YOUR media?

To be fair, NB is totally up front about this. They do not hide it at all. But... I refuse to use their services except in very rare and specific cases.