I found that the regex was compiled but never called, so echo $(id) passed and enforcement was never wired up. The pattern was _SUSPICIOUS_CHAR_RUNS = re.compile(r".+|\$\([^)]+\)").
The same missing-enforcement pattern appeared in file-tool path checks: file tool path validation.