Bot detection. It's a menace to literally everyone. Not to piss anyone off, but if you haven't dealt with it, you don't have anything of value to scrape or get access to.
What leads you to believe that bit developers are unable to set a request header?
They managed fine to set Chrome's user agent. Why do you think something like X-Browser-Validation is off limits?
That presumably gives Google the legal ammunition it needs to sue you if you do it.
To me, it seems likely that the spec is for a legally defensible User-Agent header.
It's not off-limits technically. But do you think it'll remain this simple going forward? I doubt that.