No, there should only be 1 GPU with a specific signature active at any given time.
If multiple user accounts are tainted by the same flagged signatures, than you risk getting everyone on that hardware banned. It is usually clearly stated in the EULA expected fair play section, and it is at the admins discretion... Buy that used cheap rtx3090 at your own risk... ;)
"two instances of the game can't run on the same machine at once?"
In general, most performance heavy platforms are not going to support multi-account mode anyways.
"what if I upgrade my graphics card?"
Your associated hardware signature would simply be updated upon login. However, accounts associated with flagged signatures often remain inactive to block logins/new-account-registration/store-access.
"What if my friend wants to play too, and remotes into my machine to do so?"
Depends how the admins enforce the signature collision events. In most cases, all users will get a 1 week ban, and a warning a 1 year ban will follow. Again, the admins usually have discretion about believing users stories...
"And I don't understand which cheating behaviours this restriction is supposed to prevent"
It helps prevent persistent cheats returning their hardware purchases, re-registering, and continuing to annoy other players.
This is a very common practice on Desktops, but rare on console games for obvious reasons. =3