To directly answer your topic’s title,
Since it’s a theme component, it can be bypassed by users, especially if they can enable the safe mode. That’s a “soft” limitation, sort to speak.
It also doesn’t support groups, but that could be asked as a Feature request 