They can't even consider encrypting them, since they are forced to scan for CSAM and the public overwhelmingly rejected on-device scanning. So their server needs access to the images.