Hard policy, light enforcement in practice means there is an actual shadow policy that you don't know, which is pretty bad to the point that it would be illegal if the government did it.

Their contention seems mainly focused on the heavy resource use of AI tooling.

They run a service: they could impose limits on the number of submissions, builds, branches, scans, etc, and give additional usage credits to the large community projects they want to encourage.