Well, the government has to take action against you, the site operator, if you aren't enforcing the rules correctly. That means they have to think of every pos

Well, the government has to take action against you, the site operator, if you aren't enforcing the rules correctly. That means they have to think of every possible way to monitor the traffic, both in-band and out-of-band. They then have to do this for every site on the Internet. (Or sure, just selectively enforce it against whoever X says is a threat to their ad revenue today.) When you make something, you only have to figure out one way to make it work. When you try to secure something, you have to figure out every possible way the defenses could fail, or you've done nothing.