More of the state is not allowed than is... at least by geography.

Also, there's a practical element. If I have to specify where they can't go, the default position is they can go anywhere... if I inadvertently leave an area out of my black-list where it really ought to exist: the default is "permission granted". With a white-list, the worst case is a forgotten or neglected area can't be operated in as a default and the AV provider will have an interest in correcting.

But also politics. It's a very different message to say we're going to white-list a given AV operator to exist in different areas vs. black-listing them from certain areas.