You could already just send them CSAM. That is a lot easier than finding a hash collision that also appears to be illegal content when downscaled and viewed by a human.