The timing window matters here. They're trying to regulate before the capability curve crosses the deployment barrier — once agents are cheap/fast enough to spin up in minutes, enforcement becomes a whack-a-mole problem. The race is regulatory capture vs capability proliferation.