I think I like this perspective because it points to where regulation might be more usefully applied than “the oracle must be prevented from answering certain question” and more like, “if you handle PII or provide services as a defense contractor, you may not take security advice from an oracle”