My god, I hadn't even considered that, but they're right, there's currently n established blockchain the requires permission to send anything. That's fine with money, but with NFTs that actually represent something that could be a serious risk.
There are also countries where you don't want to let the police know you own crypto because of laws against alternative currencies.
Real world comparisons don't really work well with public blockchains.
Does our legal structure support immediately transferring it to a null wallet as a disclaimer of ownership? Bob doesn't want to be the one to make that case law. Nor does he want to hand over his private key, or clean his wallet out of everything but the evil image and then hand over his private key.
Basically there are no good options, although burning the offending data by sending it to /dev/null should emerge as a valid defense. Will it?
But hey, if it was a Bored Cryptokitty, then Bob can't sell it and no one can buy it anymore, so clearly, he doesn't own it.
The same principle should apply to evil bits, the real kicker being that the whole rigamarole is now written to a shared database whose, er, immutability is part of the product on offer.
Man, the Twenties are gonna be lit.
I suspect this is perhaps a part of why OpenSea maintains a lens over all wallet content requests... the impact of a mass mailing of evil bits to wallets would be devastating to the platform, perhaps to the entire crypto ecosystem. Any corporation who wants to be seen as legitimate must have the capability to keep evil bits out of users eyes.
With post mail I'd imagine that scenario is somewhat timing-critical, whereas I'm not sure how feasible it is to delete things if they are in the blockchain (consensus for deletion? How does that work?) and the police seize all the computers in your house.
A ransomware operator could send the loot from an operation, channelled through a well publicized address, to someone they don't like which makes their account undistinguishable from that of a fence as seen by blockchain analytics firms maintaining the blacklists of addresses legit players do not task to. Or they could blackmail someone by threatening to burn their account by sending tainted funds.
Politicians could be sent unwanted donations to dirty their reputation by making it looked they're supported by the wrong people.
...
It's not that this isn't a problem with cryptocurrencies, it's just that it's a problem that already exists in the real world.
This is also why using public blockchains for storing personal information is such a stupid idea, illegal even if the GDPR is involved in any way. Blockchains are designed so no information can be altered or redacted, and that's often an overlooked problem.
Someone malicious could definitely send a collection of child porn through the mail and report you the second it arrives. If they can time it right, you could definitely be in trouble and the police would likely take all of your digital storage and search for more. It's a lot harder to do such things anonymously in the real world, where security cameras and physical mail boxes are a thing, but I wouldn't be surprised if someone would actually pull off something awful like this.
Of course, the police probably won't arrest you if you immediately report the illegal contents and hand over the evidence (or destroy the evidence without involving the police), but that's not as easy with the blockchain. Transferring the NFT out of your account would likely involve paying some kind of transfer fee (ethereum gas is quite expensive) and the police aren't going to pay that for you. You won't be finding or suing the sender of the child porn either, because this stuff isn't hard to do anonymously. Even if you do manage to transfer the illegal content out of your wallet, the blockchain will forever keep a public record of the content you once owned, so even if you do everything right the accusation of paedophilia will forever be easy to make.