I can only presume this regex is there because Google had to block various scammers trying to use email hosting donain names when novel TLDs came onto the market. You can try to manage gmail.zip or outlook.mov but Google will probably flag you as a scammer if you try to email from them. Just because web.de isn't well-known outside of German circles doesn't mean the risk doesn't exist. These email providers, especially the ones hosted by Microsoft, have a history of buying multiple TLDs to offer users a localised email domain.

Blocking a second level domain like the Ukranians tried to use is surprising, though. I guess it's to prevent domains like outlook.co.uk or something like that?

These regexes were put there for a reason so I doubt they'll get removed, but if they fix their frontend-only detection script you're going to be locked out of your domain some day if you force your way through their checks. Seems awfully risky.