This is late but I don't think "push/pull" is very clear terminology here, and confuses things a lot. The difference rather is that VPNs/TOR are ISPs, or more generally they're Common Carriers. They don't host content, they don't discriminate, they just route traffic. So Section 230 or the DMCA doesn't even apply, just regular common carrier rules. They're not liable for what goes through them short of actual knowledge or defiance of a legitimate court order, but the nature of encryption means they won't generally have any way to know or technical means. They're just infrastructure. To get content off of a VPN or TOR, someone must go to some actual server that serves said content, whether it be on the general internet or a hidden service. It's that server and user that are the liable parties. There are some edge cases, and of course differences in law for other countries, but overall they're an established thing.

IPFS in contrast would be a CDN. It actually hosts content, that's the point, it's a massively distributed filesystem. I can see that creating new legal arguments separate from pure network infrastructure.