First let's not use an unqualified label of "CSAM" when talking about generated images.

But if a thousand people see some ad then the amount of damage is not much compared to their overall business. I'd go for a healthy penalty on top, and adding in more transparency to make sure they don't hide the real extent of the problem, but it's still probably small to them.

Getting Facebook to put in a reasonable amount of blocking effort is good. But it wouldn't fully fix the problem.