The point of a policy is to make a decision and then communicate that decision, so that you don't end up in a lengthy argument (or make inconsistent decisions) each time a particular situation arises.

You're right that it won't stop anyone doing harmful things with AI - all it does is codify what is and isn't considered acceptable by a project, and make it easier to justify rejections.

If a project wants to continue evaluating submissions on a case-by-base basis (and has the manpower to do it without the support of a policy) then that's entirely their choice, of course.