Because I've been involved in software design for decades and know how these projects tend to get done. I obviously don't absolutely "know" this, not working at Marriott IT, but I do know that equivalent stuff wouldn't get done at most of the places I've worked at, and extrapolating I don't see why Marriott IT would have been so much more thorough than everyone else.

Besides, that would require the Marriott IT folks having been told exactly what the policy is, and the policy never changing. Otherwise it would require updating the website script constantly. While implementing a murky warning saying "you may be charged" would work for years on end without changes (since it would work if you got charged and also work if you didn't get charged, taking care of all possible rules with one piece of script code!).