They should (as far as they can), and Mastercard should take responsibility as far as they can. Both should take appropriate levels of responsibility given the capacity and scope that they have. I assume Pornhub already does try to directly address child abuse that is obvious from the content, I assume Mastercard can go further and identify child abuse based on known entities in their payment system, and so on. And if both fail, they should delegate information upwards, but only then.