This makes sense. AI contribution is basically just "prompt + AI work". Even if you are okay with AI work per se, you should accept prompts (after reviewing them) and let your own AI generate the code (and then also review the code)... rather then accept an output of someone else's AI with an unknown prompt, that may or may not include an instruction to create a vulnerability. In the age of AI, the prompt is becoming…
The correct policy is what Linux adopted. "We don't care what tools you use, provide high-quality PRs."