Yes, flagging is the only tool we have available indeed. But still, that is not sufficient, since the music post is still on the Steem blockchain, and the media file is still on the IPFS-backends used by DTube and DSound. However, I think this IPFS-backends are third party services that needs to be paid (done by DTube/DSound) to stay accessible. But for the first period of time, the files will be accessible, since they are paid for some time window into the future.

Steemit UI hide posts that are flagged sufficiently, but that does not mean other user interfaces hide flagged posts (well: semi hide, since it is indicated that something is hidden and you can undo that). At the moment there is no possibility build in to the Steem blockchain to DELETE a link to some illegal upload; That is a BIG FLAW IMHO. Services like VIUWLY, have the DELETE function build into their blockchain and therefore much better equipped to fight illegal uploads. LBRY has a copyright notification system similar to what YouTube has; That in itself will not prevent illegal uploads but it provided more than what the Steem blockchain and services on top of it, provides.