Having contributors doesn’t mean the maintainer is running the software project securely. Op_return can be pruned. Utxo cannot. Current return size could be used for csam, but so could the utxo data itself if one was determined enough. As a thought experiment: imagine an encoding program that processes the entire on chain data set and uses that existing data to build a rule set for encoding an image. Someone else with access to the chain and an interpreter program built to do the reverse can now see an image based on the arbitrary data of the chain. Is the chain data or the interpreter responsible for the content of the image? The interpreter is just a piece of software that is totally useless without the chain data. And the chain data is completely arbitrary. At what point is an objectionable image created?