And there's no preimage attack! So even with the unblinded hashes (which per Apple's description are encrypted with a private key they control) one couldn't construct an innocent image to match a given hash - they would need the original image too!