I don't see Visa as culpable here—no more culpable than the ISP serving PornHub, or their analytics provider, data center, ad services, or anything else. If the judge is after Visa, they should be after the others equally.
The blame for platforming the content and careless-moderation lies squarely on PornHub. And there are surely other institutions than Visa that should be obliged to take immediate serious issue with CSAM on PH.
Why isn't Visa being forced to stop providing payment processing services for liquor stores that sell alcohol to people who drive drunk and injure themselves and others? I swear, this isn't a strawman argument—Visa is as removed from culpability in this case as they are in this PornHub case, and deaths caused by drunk driving are reasonably far more damaging to human life.
The specific behavior users posting CSAM on PornHub is unquestionably damnable (and those who posted it are the most culpable, and must suffer the most consequences). This doesn't mean PornHub is a whole is a net-bad. Sex work is real work, and America has a damn hard time appreciating the aesthetics of the human body in a comfortable and unproblematic manner, and the pressure to keep PornHub hidden in the shadows reinforces the negative feedback loop of unhealthy perspectives of sex, and promotes some bad behavior—we can't culturally talk about sex comfortably and openly, when we're all made for it.
In any case, Visa's job is not to moderate the content of the internet, nor any other purchases on their platform—aside from an interested best-effort response to deny outright the sale of illegal goods and services. Visa should be able to fine or sue PornHub for breach of contract. Or increase their payment processing fees, and force them provide reports and transparency.
It is not ok for Visa to feel forced by external pressure to cut off this entire business category as a whole.