On the one hand, no CSAM-distribution platform should get to claim ignorance about the data if the files are not called .jpg but .dat. But on the other hand, the Bitcoin network can hardly be called a CSAM-distribution platform or protocol, given the high costs involved in distribution.

I haven't tried Knots, but I'm pretty sure Bitcoin Core doesn't show pictures even if you put valid JPEG or PNG data into a transaction. So the client can't be claimed to be for viewing CSAM, and those who actually want to view that content wouldn't download the blockchain or monitor the mempool to get a byte of CSAM per gigabyte of data. There really are better tools for the job.

A client that could read image data in OP_RETURN data can trivially be extended to read image data in more obfuscated parts of the blockchain. To claim that having to know the serialization of a transaction so you can clip off any extra data is somehow trivial - while doing the same thing and concatenating multiple 40-byte OP_RETURN scripts to see if there's an image - is mental gymnastics.

But you're only concerned about illegal content in the mempool and don't want to be complicit in it, while you ignore it once it's in the blockchain. So how would a file-sharing protocol look if it were to use the mempool and Bitcoin network for that purpose?

A mempool-based file-sharing protocol would have to use actual UTXOs and sufficient fees to make the cut into the 300 MB default mempool - but please, without getting mined, a 100 kB picture would cost $120 at least. So the protocol would rely on a backlog being reliably available, or else it would be expensive even at 1 sat/vB. But let's assume we somehow get to full mempools again. That file-sharing system piggybacking on Bitcoin would snipe some of the last 5% of the mempool to spread globally but without getting mined? A file-sharing system with a total capacity of 15 MB? To claim that this was actually file-sharing and not simply trolling to attack Bitcoin would be ridiculous.