I looked closely but I cannot find anything that says that paying customers are excluded. So I would assume it is included.

It makes sense, though, to enforce one single policy: otherwise, just becoming a paying customer would be a loophole to circumvent phishing etc policies.

I guess the crux here is when, exactly, they start scanning the content. Is that perhaps the moment the content is first shared?

It doesn’t seem to be documented.