> If the company decides that a certain user should not see the website, the user will not see the website, and no one will know about it, and the user will have no recourse.

If the the processing is subject to GDPR (e.g. if controller is in EU) then you do have recourse. You can complain to DPA or sue the company. The company is ultimately responsible for the decision to block you, at least in cases where you personally tried to access the site.