"There are abuses" is really an understatement. "It's mostly abuse and there might be some legitimate beneficiaries" would be more correct.
I have discussed this topic with many other engineers (known from engineering school, from working 13+ years in the Paris tech startup ecosystem and from my worker union, whose scope include most tech companies) and I have never heard any of them saying they did not write bullshit CIR reports for bullshit projects. I have myself written my fair share of those bullshit reports. There are even companies whose business is to write the bullshit reports for you in exchange for x% of your CIR credit. I worked with such company.
I don't remember having to defend anything to get the CIR, it's more of a judgment call on whether you feel confident to defend it if you get an audit, and these are very rare. We've had such audit in the past, and it made everyone rewrite each submitted report in a hurry to make them look more serious. No sanction were applied.
At this point, my opinion is that the CIR has very little to do with actual research, but rather it's a discretionary tax subsidy for sectors in which France wants to be competitive.