There’s gotta be some kind of limited liability for this kind of thing. I mean, banks wouldn’t be liable if someone put csam in a safe deposit box or (assuming they don’t x-ray packages) UPS shipping csam in a sealed package. I think there just needs to be reasonable safeguards against it but I don’t know if any of that is built into the software.
I could also see this turning into a form of DoS attack. I’m sure there’s very little leeway in ignoring “bad faith” reports so if you have an instance you could be responsible for investigating thousands of reports per day. And if you take the safe route and remove anything that’s reported, until deemed safe, you might as well turn off your instance.