Regulation does not have to be prescriptive - in fact it is more efficient if it is not. For example, health and safety regs require you to minimise risk so far as reasonably practicable - and in every case the reasonable practicability is considered.
In football there are non specific rules such as ungentlemanly conduct and bringing the game into disrepute which allow governing bodies to develop accepted ways of behaviour by precedent, rather than trying to specify every last action. For example, nothing specifies that managers shouldn’t kick water bottles into crowds, but it has become accepted as unacceptable and frequently results in punishment.
It is incidents such as this current industrial espionage affair, and the action then taken, that create the precedent which sets future acceptable behaviour.