The researchers are looking at actual posts on actual servers. The research itself is not made up. The speculation and handwaving that the tech press feels the need to introduce into it? That's made up.

As for why would anyone use Mastodon for it — your typical Internet pedophile isn't any smarter than your typical Internet user, and half of those are below average.

While I don't agree with the author's use of "major CSAM problem", if you browse instance federation list, you might notice a few mastodon instances that suggest they might be a MAPs community at best (domain name like pedo-school, mapsupport, etc usually with cute dolls in their banner image). They are closed community so can't see what happening inside.