Tell me you haven't read the material supporting the Online Safety Act, without telling me.
In any case, you're wrong. The majority of it is nothing to do with CSAM either.
But...there was no need for a law against that, because - just like everything else - there was already a law preventing it. Successive governments have just failed completely to enforce them.
The Online Safety Act is about two things: shifting responsibility for enforcing the laws of the UK online from the police and CPS to private companies and individuals running websites, and making legal content illegal to distribute. When you boil it down, that's all it does. The bit that people are seeing right now - the age checks - are just the tiny bit poking up above the water.
Of course, "all" is doing a lot of heavy lifting here; the government knows full-well that people and companies running in-scope services are going to over-correct and censor far more than is required. That's why they set the penalty so high - £18m or 10% of global revenue, whichever is greater. That way, the government figured they couldn't be accused of censorship because they're not the ones taking action.
That over-correction, for example, is why young girls can no longer access information about menstrual health in the places they'd normally look for it - it's age-gated to 18+ only in most places, because the companies running these sites are absolutely terrified of the massive fine that Ofcom have threatened them with. Same goes for mental health support sites etc.
The government, of course, are doing exactly what the previous administration planned to do - "It's not our fault, we're not making these companies do anything, we didn't tell them to do that". Why? Because Ofcom is exactly the same entity it was before the election, and the people behind the law (and the rules that Ofcom set independently of Parliament) are the same people. Everything is, as far as they're concerned, going to plan - including the widespread use of VPNs (something Ofcom has wanted to ban for over a decade now).
So....continue to support it if you like, but at least have the self-awareness to realise that the blast radius of this law goes way beyond the things you don't like, and that it barely affects your intended targets because it's trivial to evade.
EDIT: What on earth do you mean about Zuckerberg using a VPN to spy on Meta users' data? Why would he need a VPN for that, when his company is hosting the data in the first place? Do you have any idea what the words you used mean?