One of the major issues around this policy is the line that is drawn between privacy versus security. Why is invasive scanning of existing data generally accepted but surveillance of one's private space not?

I'm thinking it has to do with the idea that "you" are the one that owns "your" device, whose subversion is the cause of a lot of the backlash.

But I think that if governments are able to compel companies to not let thir data warehouses become private spaces that allow criminal enterprises to flourish, they would do so. Corporations wouldn't become triggers for outrage if other forces surveil their physical or virtual premises - regulation is expected. They can grow to have too much power, and in order to continue existing they have to cooperate with external forces that keep them in check. The standards of individual liberty seem to be applied differently between individuals' private spaces and corporations.

But a lot of times, I think that there isn't an equivalent distinction between a hard drive in one's own room and one out of millions in a remote data center. Exposing a personal hard drive to the internet and breaking down someone's door both carry the possibility of criminal liability, but the former has many more legitimate use cases. It has always been possible to incriminate oneself from a sealed room with only an Internet connection depending on what kind of data you're trafficking, and maybe the possibility of on-device scanning will cause more people to learn of that fact.

I believe the misunderstanding is that Apple assumes that the impression they're giving is that only those that consent to allowing the corporation to assist them in their lives will be subjected to that corporation's policies that prohibit the assistance from being criminal in nature, and it's irrelevant if that process is moved to the device. But Apple's assumption was wrong, and many people stopped trusting them. And because of that severe loss of trust in particular, their promises stopped being effective in dismissing counterarguments. Almost everything about this issue revolves around who will be compelled to implement what technological controls by whom else, and about the only things that are being used to refute the worst case scenario are what have essentially become meaningless promises because of the significant loss of trust. But even so, meaningless promises are all that reassure us that any given corporation won't go rogue at any time, regardless of what laws or morals exist, and promising that these features will save children from harm has, up to this point, been a promise that has been accepted and forgotten about.

To be clear, I think Apple's strategy is a mistake, and that the scan should be kept off the device. That is from the standpoint of how to effectively hold corporations accountable, who hold a significant amount of power in incentivizing human behavior, be it addictive or criminal. And in the current society where corporations need to know if they're enabling criminals by learning about the nature of their interactions, complete privacy can never be achieved. There will have to be a loss of some amount of privacy at some step in the process, but there is still such a thing as losing too much privacy.