Why does the allowOTAUpgrade API method, in the Knox SDK, have no effect when allowFirmwareRecovery() is set to false?

The allowFirmwareRecovery API method is the stricter of the two policies. Having allowFirmwareRecovery set to false disallows all the methods of updating the device firmware, be it flashing via download mode, updating over the air (OTA)(From Knox Standard SDK v2.9, allowFirmwareRecovery does not affect OTA) or via computer using Samsung smart switch.