CSAM is not software. It is content. In a reasonable world, there should be consequences for possessing it. Implementing these consequences on a technical level would be an egregious affront to our freedoms.
software vs content is an irrelevant distinction, they're both digital objects composed of files and bytes. I see no reason the government should not able to regulate either one of them. The government already regulates lots of software via ITAR laws.
