I agree it would be more privacy-conscious to do the banning in the opposite way, by putting the banning logic on the end device, and mandating websites to send a signal that they are banned for minors. This header already exists (and for some reason it's a really long random-ish string). Someone should propose this to lawmakers.

Since the law doesn't actually say how it should be implemented, it's compatible with existing law. Actually I wonder if simply sending the "I am 18+" header would already be legal in Australia. Probably not, on the basis that it doesn't actually work right now, but maybe they could convince a judge that it's actually the browser's fault it doesn't respect the header.

You are giving authoritarians benefit of a doubt for no good reason. Vagueness in such laws is usually to allow selective enforcement by the people in power and not for you (a regular user) to have an "escape hatch" from negative consequences of the law. The reality of the situation is that there are currently no other ways to enforce age checks besides asking for an id and any kind of theoretical parental-controls-configured browser headers are years away from deployment, best case.