Devil's advocate: OPs approach is a form of inoculation against the ad-powered Internet. The experience may not be pleasant, but drives the right message and quite memorably so.
My sympathies are entirely on the side of the game's author. It's just an obscene image -- the "collateral damage" in this case is perfectly acceptable and imo fair because it damages the brands of the illegal hosters.
However as a gay nerd I'm not really interested in having children, so I'll just have to leave it up to the village.
I think you'd probably agree that, say, overwriting every file on the end user's computer with a text file complaining about how the iframe-wielding website steals content would be an unacceptable thing for the author to do. But the only difference would be the degree of suffering inflicted on the innocent bystander.
If you think this image is acceptable to show to young kids, are there any images you think are unacceptable to show them?
Also the phrase "you think this image is acceptable to show to young kids" subtly alters my position in a disingenuous and (I think) intentional way. My position is not that you should "show young kids goatse" but that "a young kid seeing a flash of goatse isn't really a big deal". They might laugh, they might be a little grossed out, they might be curious why someone would do something so strange. I think the idea that they would be "harmed" or "traumatized" is pure adult projection.
I think there is a genuine change in meaning, coming from your use of the word "should":
>My position is not that you should "show young kids goatse
But that's not a word I used (or intended).
ETA: Agree on images of violence.
A very annoying, loud, visually busy animation would've sufficed. Baby shark at maximum volume, or a continuous fart sound, or maybe just a high pitched beep would also sufficiently scare away people.
By showing porn in a place that he knows minors and other protected groups will visit, they violate decency laws in a whole bunch of countries. They probably wouldn't if this was accidental (i.e. they sold their domain to a third party that turned it into a porn site) but in this case they admit this was very much intentional.
For example a woman breast-feeding or a man peeing on a tree on the side of the road.
They may have had a defence if this hotlink prevention was already there from the beginning, but this post explicitly admits that this was added intentionally in response, and that there were plenty of other options that could've been taken.
When it comes to many laws, intent matters a lot. You can make technical arguments about the nature of all networking all you want ("technically HTTP is a request/response system so if I just requested the server to delete all customer data I didn't hack it the system just foolishly accepted my request") but the real world doesn't really care about CORS and iframe policies as it does about not being exposed to some guys erect penis and stretched out anus.