I think that's fair, but I also think that any solution that reduces the problem in any part of the stack is worth doing. Defensive clients, ML models, filtering relays, good Media servers, easy ways to report csam, Web of trust solutions, etc.