I take this story as a clear sign that they are careless & it most likely IS happening at some scale in systems that generate/personalize ad variants, chatbots, suggested interactions, etc. For another example of shipping very inappropriate things:
Back to the original inference, anyway… generative ad Personalization instances DO NOT (afaik) appear in the public repository of ads. Researchers can't see it, but do we have to strain our imaginations to think that things like nudify apps aren't taking advantage of tools that do things like drop user avatars into their pitch? e.g. https://www.reddit.com/r/Fauxmoi/comments/1uhy9yn/instagram_...
I don't have a specific citation to offer, but tbh I've seen enough.
You think Meta is going to create CSAM with my data?
Like I would dump them for using my data for analytics without my permission, but we probably should recalibrate our expectations a bit here.