That is correct. Though mods can report illegality, they can’t use the second system (called badlist, a list of hashes) themselves. They would first delete it through normal means, and then flag it. Likely this will be automated in the UI at some point.

Again, the first system is is designed to be user reversible so disabling a mod is a fairly mundane, ordinary thing that can be done easily via the UI.

Disabling the badlist obviously takes more effort but a determined person would be able to disable it, I’d presume. Nevertheless, for the vast majority of people who don’t disable the badlist, they would still be protected against those who disable it since the filter would protect their computer from accepting or sharing that content. So even when badlist is disabled, the only people anybody who disables it can harm is themselves.

Basically, the badlist a courtesy provided on a best-effort basis, so that your computer doesn’t share sketchy content, because if it does, you are legally responsible for it.

This isn’t the best system probably, but until I find something that works better in practice, this is good enough. When it comes to these kind of things, hope is not a strategy.