Surely this won’t block lots of legitimate users, while simultaneously being trivially easy to bypass by submitting a picture of literally anyone.

Know thy enemy.

Surveillance cameras are fine imo. It’s connecting those cameras to some random server you don’t control that’s the concerning part.