It's my understanding that, in the U.S. at least, there are strict liability laws around CSAM that make it more difficult to store or produce it, even as part of red teaming and applying safety mitigations.
I think there should be exemptions of sorts for companies to do important safety testing, but they still need to put resourcing behind it and go ahead in carrying out and using the guardrails. That alone would not be enough.