--disallow-code-generation-from-strings does not work as documented

Doc: https://nodejs.org/docs/latest/api/cli.html#--disallow-code-generation-from-strings

It is advertised to cover built-in language features, but it doesn't cover data imports

No Node.js modules are directly imported here

// run with node and node --disallow-code-generation-from-strings
const payload = 'console.log("evaluated code from string")'
try { eval(payload) } catch (e) { console.log(e.message) }
try { new Function(payload)() } catch (e) { console.log(e.message) }
try { await import('data:text/javascript,' + payload) } catch (e) { console.log(e.message) }

Output:

% node --disallow-code-generation-from-strings 1.js
Code generation from strings disallowed for this context
Code generation from strings disallowed for this context
evaluated code from string

Run the issue's 1.js reproduction with Node.js and with --disallow-code-generation-from-strings, then compare the eval, new Function, and data import results with the CLI documentation linked in the issue. Trace the handling of this option for data imports; done means the observed behavior matches the documented coverage, with regression coverage for all three cases.