You are correct in that both option 1 and 2 are possible. For end-to-end encrypted messages only option 2 is possible. The content will be scanned directly on your own device and the data will be sent to the authorities without your knowledge, if the software detects something suspicious. This is called client-side-scanning.