Would every node need to switch from core to prevent the ledger from containing illegal data?
Discussion
Not every node.
At the moment 99.9% of Bitcoin Nodes filter transaction that contain OP_RETURN of biggere than 83 Bytes. (all nodes are good, except the few that belong to Peter Todd Libreralay)
What the Nodes do is they don't relay transaction to other nodes that violate their filter settings (for example when they contain OP_RETRUN with more than 83 Bytes)
If the majority of nodes do not relay those spam transactions (non-monetary transactions) they don't get added into the current blocks that are to be mined from miners.
The really malicious Core V30 will need to get big % of the nodes to be able to be really malicous.
I doubt they will get a lot of traction. We will see. But its important more people run Bitcoin Knots or not upgrade to Core V30
The Knots option is better because it fixes inscription spam as well, which compromised Core devs deliberately left unfixed.
Todd had to turn core into Libre Relay because he couldn't get anyone to run it otherwise.