> I doubt Apple "allows" it. Apple probably even forbids it in their Terms of Service.

Encrocrypt and Cyberbunker probably had terms saying not to do illegal things...

What matters is how they respond to problems as they are pointed out. If it would turn out that links to their hosting service keep popping up in child abuse cases, do they respond by deleting them piecemeal or do they put a system in place that tries to identify the content by fuzzy hash and flags it for proactive review? Do they actively cooperate with the countries' law enforcement where the picture got uploaded from? That sort of thing. That has infinitely more impact than "you wouldn't download a car" notices