I don't believe any of the examples provided would have escaped an image classifier. The hypothetical where they did is one of gross incompetence IMO (and I don't think that's likely to be the case).
Even if you don't train on gore that's bad enough to trip an image classifier, the model learns the concept of "more [liquid/jam/syrup/chunks/etc.]" and that can generalize to creating gore that would trip the same classifier.
Right but if a classifier gets applied to the final output before the image is sent back to the user then it should catch that. Several remarkably accurate and very lightweight open weights models intended for moderation are freely available at this point.
Even if you don't train on gore that's bad enough to trip an image classifier, the model learns the concept of "more [liquid/jam/syrup/chunks/etc.]" and that can generalize to creating gore that would trip the same classifier.