What could be the rationale? Not wanting to validate the CSAM for fear of becoming responsible for it, or not wanting to hire the staff/buy the infrastructure t

What could be the rationale? Not wanting to validate the CSAM for fear of becoming responsible for it, or not wanting to hire the staff/buy the infrastructure to "cleanly" handle such stuff?