My guess would be they're using some 3rd party library of "fake user agent detection", and this library just has a whitelist of what's "acceptable".

This is just a guess, but maybe "inconsistent" identifiers are a good signal of being an attack bot instead of a user.

Not defending that btw. Auto-generated signals are likely a problem for any desktop Linux user, not just Asahi, since most bots will run on Linux VPSs.