You can pick up cod, salmon, tropical fish, pufferfish and axolotls in buckets in vanilla spawn protection. Issue for public servers: cannot put these mobs with custom nbt tags at spawn
To reproduce
Start a server
Join the server
Summon fish or axolotls at spawn
Op any player other than you (from the console) to activate spawn protection, and deop yourself
Give yourself a water bucket
Try to pick up a fish or axolotl
→ ❌ You are able to do so
Can confirm in 21w14a.