Well if it works some other way, please dump it anyway and let us all know how it works?

Edit: I'm reliably informed that it's enforced at the domain level via a bloom filter stored in /System/Library/PrivateFrameworks/WebContentRestrictions.framework/WCRFilter-2025-09-29.plist