I ran my own matrix server for a number of years, then learned that any matrix homeserver would happily serve up any media from matrix without authentication. I shut it down the next day because I have no desire to operate a proxy for downloading csam.

A url like https://my.domain.com/_matrix/media/<some.other.domain>/<some-bad-media-id> would happily proxy the bad media through my server.

I think they've fixed this, but it's not worth the risk to me.

Yes they fixed that about a year ago. It was a breaking change and required everyone to update their server software config.