There's a bit of that sometimes (and I think the general safety protocols in the submersable rating standards they ignored were kinda like that, though it wasn't impossible, it was just "If you're doing something nonstandard, you need to test the shit out of it", which involved needing to build multiple full-scale prototypes to do long and destructive tests on, which is hella expensive but also realistically the kind of thing I'd really like to see for something I'm going to put between me and the depths of the ocean). These rules were for the most part written by experts who knew what kinds of things can go wrong and how to build as much confidence in a new design as possible.

But on the other hand, you also get people making such rules who really don't know their stuff, and who have a reflexive tendancy to add rules 'just in case', without allowing for judgement or thought in the process. Because they don't know what's going on, they often produce rulesets that are both overconstraining and insufficient, sometimes in ways that are counterproductive to their goals. Areas where I've seen this: Medical device regulation (I've seen how the sausage is made, and it's shockingly easy to get absolute crap approved but a good design can get caught up in endless headaches by box-ticking), IT security processes (endless checklists of 'best practices', very little sensible risk assessment, threat modeling, or red-teaming, huge incentives for people to workaround the system as intended, creating more security holes). UL safety regs entered a bit of a spiral of this at one point as well: they started just playing whack-a-mole with rules and wound up with something that was really difficult to implement but didn't really improve safety. EU standards actually tend to be pretty sensible in this regard (at least outside medical areas). Company health and safety can easily fall into this trap as well, if run incompetently.