"Allegedly" is a very operative word there. Pornhub was actually extremely aggressive about removing CSAM and nonconsensual content, to the point where Facebook was actually a far larger problem for those actually concerned with stopping CSAM[0], with three orders of magnitude more instances on Facebook than all Mindgeek websites (including Pornhub) combined.
However, groups like the ones I mentioned only targeted Pornhub, because they don't actually care about CSAM. Their goal is to eliminate pornography and all "immoral" content, where "immoral" is defined according to an explicitly religious, right-wing interpretation of the term. That's not a secret; that's how they advertise themselves, and that includes the group in question here, Collective Shout[1], although the latter is now trying to hide that tie via futher censorship[2].
Because going after Facebook doesn't fit into an agenda of banning pornography, you'll never hear them mention one word about CSAM or other horrendous abuse that happens on Facebook and is facilitated by the platform.
> Furthermore, material considered a brand risk is also not allowed but payment processors a step down are the ones who make the guidelines on what that means in practice.
That's not quite true. Processors can set their own restrictions, but so can Visa/Mastercard/etc, and they absolutely do police perceived brand risk, which includes not just pornography, but also completely nonsexual content as well.,
[0] https://www.thedailybeast.com/facebook-a-hotbed-of-child-sex...
[1] https://www.notebookcheck.net/After-payment-processors-promp...
[2] https://bsky.app/profile/acvalens.net/post/3lufjdqmhxs2v
You're not wrong but that's only part of the story. What you're describing happens, which leads to overly-conservative interpretations of the unwritten policies. But the card brands do also have explicit rules that they expect downstream players to adhere to.
Confusingly - and this is where your impression (which is common) likely comes from - the card brands themselves provide different rules to different downstream providers, so it's not like there's one single, consistent list of rules for Visa globally (for example). It's not law and they are not bound by precedent or even an expectation of consistency.