Fyi, admins have the protection of federal law to not be held responsible, as long as they take action when it happens.

Correct, emphasis mine. As long as they take action when it happens being the key phrase here.

IANAL but from what I understand, doing something to take action (removing content, disabling communites, banning users, all of the above) shows that they are working to remove the content. This is why previously when having conversations with people about the topic of piracy I mentioned DCMA takedown notices and how the companies I’ve worked at responded to those with extreme importance (sometimes the higher ups would walk over to the devs and make sure the content was deleted).

I’m annoyed at people in this thread who believe that the admins did the wrong thing, because turning off communities could cause users to go to another instance - who cares, this is bigger than site engagement. I’m annoyed at people who think that the devs had access to code which could prevent this issue but chose not to implement that code - this is a larger and much more difficult problem that can’t just be coded away, it usually involves humans to verify the code is working and correct false-positives and false-negatives.

I'm a victim of CSAM and my dad exploited me for several websites.

I get being upset about this. But it's not the end of the world for a site. Lemmy is still totally fine and I have been using it without seeing any CSAM and the only knowledge I even have of this is from posts like OP's.

Like this isn't a good time to be just down on the site and pessimistic.