I think the parent is distinguishing between messages & the attachments as they are stored differently & often in different places in many systems. But I agree with you in assuming that the goal would ultimately be to then start scanning messages too.

Imagine governments used something like SHA1 that has conflicts & now you have collision potential–you could even fabricate attachments that could cause a collision to get someone throw in jail since all you have to rely on is the file hashes. If you can’t scan the actually content & you are just using hashes, then you also don’t prevent new content that those in power deem ‘bad’ from being flagged either which doesn’t really stop the proliferation of the ‘bad thing’ just specific known ‘bad things’. If I were implementing clients, I would start adding random bits to the metadata so the hashes always change.

The only way this system even works is if there are centralized points the governments/corporations can control. Chalk this up as another point for supporting decentralization & lightweight self-hosting since it would be impossible to have oversight over such a system if anyone can spin up a personal server in their bedroom.