I would argue that even for larger websites this would not be a valid logic either. Such websites might have a team responsible for such issues, but this is not

I would argue that even for larger websites this would not be a valid logic either. Such websites might have a team responsible for such issues, but this is not the service these websites provide nor the primary way of operation for these websites but rather a way to mitigates risks. Such risks burden the websites and are raising costs for the websites to operate. It's an abuse of service somewhat similar to shoplifting. Your analogy with mystery shopper doesn't hold the water as well since the researchers in such cases are just executing the primary function of the businesses in question. So while for the bigger sites you might be correct that the research is not a human subject research but it's still an abuse of service which in unethical without consent as well.