Or even banning at all. As you say, kick out of an abundance of caution. Any serious attempt at rule breaking is going to involve at least some basic obfuscation so if that's missing it's a strong indicator of a false positive.

That said, my snarky response is "I hope you learned your lesson about the need to restrict proprietary software to a container at all times".