They're also blocking curl on macOS (but not wget on macOS) so this seems like an aggressive WAF rule.
I even tried it with Firefox "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" -- works just fine.
Marriott Web site works fine for me. Firefox on Debian Linux. Fresh install, so there were no prior cookies or other data from Marriott on this computer that could have hinted I was a repeat visitor.