An ISP is protected under common carrier laws. To assume a Bitcoin node is somehow going to get the same treatment is overplaying your hand. Especially when there is currently another version of the software that gives a best effort to avoid spreading it, where as the other implementation invites it in. And the most damaging risk isn’t courts, it’s a reporter with no tools saying “look csam on Bitcoin”. Expending OP_Return makes csam easily visable to anyone with an explorer and not buried in witness gibberish. Being techically sound isn't everything and there is a serious human element missing here. I think the core side is really missing that.