You can pick up cod, salmon, tropical fish, pufferfish and axolotls in buckets in vanilla spawn protection. Issue for public servers: cannot put these mobs with custom nbt tags at spawn

To reproduce

1. Start a server
2. Join the server
3. Summon fish or axolotls at spawn
4. Op any player other than you (from the console) to activate spawn protection, and deop yourself
5. Give yourself a water bucket
6. Try to pick up a fish or axolotl
   → You are able to do so