It’s also a weird argument.
You can only spend your money once, and the affected employees also chose to work for a bell-end like Altman (or Zuck, or Musk)
Your attempt has similarities to the idea behind Checking Sec-Fetch-Site. Implementing that header is the same amount of work. But this header is exactly meant for this purpose, and referer is haunted with problems.
So for officially intended protections, implementing this header and samesite cookies gets you a very long way without any complexity, assumptions, or tricks of old lore.