this can't be "fixed" due to the way merkle trees work, any "fix" would undoubtedly break real p2tr scripts

I think there is a way to fix it without breaking real p2tr scripts. Create a filter that checks if a control block, when parsed as a single hexadecimal string, contains a valid image format. If so, filter that transaction. Done.