From a tort perspective, it seems like the client assumes all the risk of an HTTP request: I made a request for this URI - without (obviously) knowing its contents - and you send me some contents. Even if I as the client attempt to send a malicious payload, etc. the server can transmit back whatever it would like any time - that's the rules of the game.
So the server holds all the power, and as long as I got a "200 OK" response with whatever contents you sent me, you have absolved the client of wrongdoing without a much bigger burden of proof of fraud, identity theft, etc...
Otherwise, the Internet literally becomes unusable - if even submitting this comment might result in me receiving illegal content, how does one proceed?
Sidenote: this is tangentially similar to the CitiGroup Revlon case, where Citi accidentally paid out the full principal on a loan to Revlon to a bunch of small lenders, and the lenders refused to return the money.
https://www.npr.org/transcripts/1019909860
The court ruling is interesting, in that as long as the lenders assumed the money was sent on purpose - that that was the intention of CitiGroup - then there was no reason to send the money back. But if they assumed the money was sent on accident, then it was illegal to keep it.
The court ruled that under good faith argumentation ("discharge of value") that if someone owes you money and they pay it back, even "on accident" or otherwise, you have no obligation to return it.
And again, it hinged not on the individual case per se but the effect of ruling otherwise - that you could never truly spend money that was sent to you because someone might come later and claw it back, which would just grind the financial industry to a halt.
I think the same conclusion would have to be made here: if you send something and stick a 200 on it, the recipients are entitled to what you sent them.