It's an difficult ethical dilemma. How are we categorizing the harm done to victims of child pornography? Is it based on how many different people see the same image or just the number of times the images was viewed in general? Obviously the victim isn't getting some sort of electric shock every time somebody sees the image.
Do we include it additional harm if the identifying features of the child in question are unavailable? What if the victim doesn't know they were part of the training model or that there are even images of them on the Internet? Would it be ethical if training data from children in non-pornographic situations was used? What if somebody had child pornography made of them but allow their image to be used (donated?) after they were 18?
I'm not claiming to know the answers.