Even though Graf is lying about pedophiles being here (he does that every time he wants to block something) he's not even wrong about the problem.
Even if Gleason's model for Ditto works perfectly, someone will always be able to instantly generate 1000 keypairs apart from Ditto and start spamming any instance they want and there's literally nothing you can do except regex or broad filters or manual moderation, and that's only a bandaid. At best you can train a model to catch probable spam, but big companies already do that and they're always flooded with smarter spam every few months.
There are unironic paedophiles on nostr. I'm not saying it's as big a problem as the spam but they're definitely here, along with people who may just be posting csam to be edgelords or to hurt the protocol.
I've only ever seen one and he moved here from Pleroma.
It's entirely possible there are more though. It's kind of impossible to find anyone on here unless you just stalk global, or follow people indiscriminately.