Yeah, you're right. I knew it had always been possible to commit arbitrary data to the blockchain, but until now I figured there was a cap or something (i.e. not approaching the 4 Mb limit!). I didn't realise this has always been possible. 

orthwyrm

bitcoin

Someone just took up the entire blockspace of a block with a wizard NFT/Ordinal

slatheredloss

That's been possible since day zero. Indeed, I've seen claims that someone already has published CP in the blockchain, though I haven't bothered to try to verify that myself.

You can hide illicit images in all kinds of public archives. For example, you can easily hide stuff in git commits – my OpenTimestamps actually takes advantage of this to timestamp git commits. Due to how git works, it's very annoying to remove as you'd have to rewrite the entire repo past the point the data was added.