The researchers can't be taken seriously if they don't acknowledge that you can't force free software to do something you don't want it to.
Even if we started way down at the stack and we added a CSAM hash scanner to the Linux kernel, people would just fork the kernel and use their own build without it.
Same goes for nginx or any other web server or web proxy. Same goes for Tor. Same goes for Mastodon or any other Fedi/ActivityPub implementation.
It. Does. Not*. Work.
* Please, prove me wrong, I'm not all knowing, but short of total surveillance, I see no technical solution to this.