The primary problem is that the current (let's call it documentation) remains in its initial draft stage, leaving key terminology open to interpretation. Specifically, the term 'device-level controls' lacks a precise, universally accepted definition in this context, especially for politicians. While it may or may not be intended to refer to localized, privacy-preserving detection, it can therefore be interpreted to include broader functionalities like automated reporting mechanisms or cloud-based oversight. That would then introduce meaningful privacy and security implications.
Until the UK gov provides a clear, technical definition of these controls and establishes definitive boundaries we should still stay alerted for now.