Some ethical questions are very subtle, it doesn't strike me as malicious. I feel like their logic is valid for larger websites where you have teams of people handling these questions, and even possibly for smaller website that are incorporated.
There is a lot of precedent in using the mystery shopper technique to assess companies that aren't considered Human Subjects Research even if the interface to that company is a single human being.
I would argue that even for larger websites this would not be a valid logic either. Such websites might have a team responsible for such issues, but this is not the service these websites provide nor the primary way of operation for these websites but rather a way to mitigates risks. Such risks burden the websites and are raising costs for the websites to operate. It's an abuse of service somewhat similar to shoplifting.
Your analogy with mystery shopper doesn't hold the water as well since the researchers in such cases are just executing the primary function of the businesses in question. So while for the bigger sites you might be correct that the research is not a human subject research but it's still an abuse of service which in unethical without consent as well.
There is a lot of precedent in using the mystery shopper technique to assess companies that aren't considered Human Subjects Research even if the interface to that company is a single human being.