The legitimate use case is basically: I am placing this outbound call over VOIP or a different phone line, but I want this ANI to show up on the callee's phone, so when they call back they go to the correct line (dentist's desk, software sales line, whatever)
The goal of the regulation is to cut down spam/scam calling, not legitimate uses, and the telecom providers know these uses and lobby heavily to make sure they'll still be allowed to work.
The telecom providers don't like scam calls either, or more specifically they don't like short calls. All the work and compute power in telecom is used to set up the call, then the cost of keeping it going is minimal so the longer the call goes on, the more economical it is for the provider
Based on the given situation, the museum won't own the caller's cell phone number that they're trying to legitimately spoof for their staff's cell phone.
Asterisk is an open-source PBX system.
I think the original call will come in with the correct STIR/SHAKEN-validated SIP headers and the PBX can forward them as is, see some discussion here: https://community.freepbx.org/t/stop-robocalls-act/60921/5
I previously worked at a telecom software company, and I know everyone with their shit together has been preparing for this for a long time, which is why I'm not concerned that these common cases should continue working. These softwares are often built on top of or on a branch of Freeswitch/Asterisk.