Sounds like how the EU is usually doing this. Limit the companies, not the people directly.

How is this kind of testing relevant anymore? Isn’t it creating an unrealistic situation, given the brave new world of AI everywhere?

+1 for avoiding dynamically constructed identifiers when possible. Fulltext search across multiple files is available in most tools, let it be useful. It sucks having to search for a substring, hoping you guessed the way it gets constructed. Plus, it might not even occur to you that this is what you need to try.