And if I'm correct, then the whole Knots CSAM argument is just fear mongei, right?

So then is it that the level of effort required to contort that back into a picture is high enough that it’s not a legal problem for node runners? The effort required is (significantly) lower if it’s in opreturn? Vaguely heard about this.

Yeah, see how it uses "OP_PUSHDATA2" over and over again? That makes the data non-contiguous because the there is a byte limit when you push data on the stack. (Or else the script doesn't know where your transaction ends) this is not 100kb CONTIGUOUS data. Meaning it IS chunked up.

Ok, so the main difference is that in witness encoded data you have "4d" inserted every 520 bytes, but it only costs 1/4 of fees?

Well, not exactly. Contiguous bytes that amount to CSAM, or malware in general would cause people who run a VPS node to probably have their VM shut down. That's probably 20% of the node netwprk, including major players like exchanges and mining orgs. THAT is the attack vector. Then the mitigations would be effectively having VPS providers whitelist Malware (which they won't). Having the pushbytes allows the data to be segmented and it won't trip malware detection. Nothing to do with the fees.