2. Hash checking requires a 1:1 match to be flagged.
3. Any match is reviewed by law enforcement to confirm it matches what is recorded in the CSAM. This is checking your file against a descriptive record of what the file is.
4. The chance of a mismatch is so remote that its not even an issue for me. Even if you do get a mismatch it is a human that reviews it.
5. To submit a file to CSAM requires a lengthy detailed process where multiple humans review and approve before creating the Hash.
6. Every hash has a chain of custody. So if in the unlikely chance of something else being put into CSAM, you can see all the people that interacted with the system to put that hash in.
7. Service providers can be sued for content they submitted, so they have a prerogative to ensure what goes in is valid.
This process has been in place for 15 years or so.