The problem is you can't prove if AI was used or not so Debian's response is actually the most logical one. If anyone uses AI they're still responsible for what they submit.