restricting with recursive covenants would be extremely complex to do, just like a multisig KYC lock would be. But both are possible in theory. One can be done today, the other requires a softfork.
Your intuition is wrong, so I suggest you take your own advice and research more.