Difference is your ISP will actually turn you in to the police on a silver platter if you distribute CSAM. So will every reputable tech company. Actively harboring that activity and claiming privacy rights when the data is plaintext is criminal.