You noticed that, did you? If I ask a small child to draw a picture of a sunflower - and they have never seen a picture of a sunflower, but they are sitting in a field of sunflowers - is it your contention that they would be unable, because they've never seen a picture?
Because I think the small child will manage it. And the AI with no training data won't.
But yes, to answer your broader question, I think it is reasonable to have legislation around automated or large scale processes that don't pertain to something an individual can do. Which is why there is regulation around robocalling, sending spam and photocopying and selling books.