I'm fine with either approach, though adding the READ_RESTRICTED flag would also be fine.

The audit trailing leading to a bypass is very important, and traversing frames to find functions in their locals or closures is very useful.

This is nothing like a traditional sandbox, which we can't do because there are (few) legitimate uses and (many) existing users of our internal interpreter state inspection/mutation APIs. This is about tracing internal events - hence _audit_ events - so we want them for all equivalent ways to achieve the same internal inspection/mutation.